Criminal Case Investigation, Case Study Example

When reviewing the files, it is also critical to determine which ones have been renamed by ensuring that the names correspond to the file type. The mismatch between the file title and the file type can reveal evidence that will be useful in the investigation (Mason et al., 2015). For example, to begin an investigation into an electronic device, such as a flash drive, it is necessary to create a bitstream image of the device. A bitstream image is a perfect replica of the original drive. Everything is copied online on the flash drive such that it becomes easy to get back the files that had been lost accidentally (Chetry & Sharma, 2019). This is done to keep the original evidence in its original state, ensuring that it is not compromised and that there is no tampering with the evidence.

There are a few of the tools that I would use to process the evidence gathered by the criminal investigator. The first step is to conduct an in-depth analysis of the drive to determine the relevant evidence for the case by applying an EnCase (Wilson et al., 2020). Using the tool, it is possible to get data virtually from any device, decrypt, and collect using this software, which also has the added benefit of preserving the data. Finally, the information would be sorted out for the investigation’s best outcomes.

I would also use Active UNERASER to try and solve the issue. Active UNERASER is a piece of software that makes it possible to recover deleted files. It can also recover folders from re-formatted volumes on various file systems. It can also restore files and folders that have been deleted or damaged (Al Mutawa et al., 2019). I would use this program to figure out which images the suspect deleted and which files were renamed, among other things. Once I collect all of the deleted files, I would proceed to the next step of my process, which would involve using the Win Hex software.

Win Hex is a powerful editor that helps access all of the files, clusters, and bits, among other files, stored on the computer’s hard drive. I would use this program to determine if the file edited in a hex format was an original image file or not (Patil et al., 2022). The final step is to determine whether or not steganography was employed on any of the files on the flash drive. It is essential to look for any large files that could be used as a carrier for the information. After that, I’d look for any duplicate files or images to compare them with (Nikkel, 2020). A secret message is no longer randomly distributed when a secret message is inserted into an image. Any of the deleted files could contain programs used for steganography; therefore, if such a program is discovered, it will aid in identifying what was concealed.

In conclusion, every step of the process that has been completed must be exclusively documented so that there are no unanswerable questions. It is ensured that the original evidence is preserved exactly as it was discovered with no alterations by creating a bitstream image. The recovery and evidence process is carried out on the mirror image copy. It is now possible to present all of the evidence gathered during the investigation in court for prosecution.

References

Al Mutawa, N., Bryce, J., Franqueira, V. N., Marrington, A., & Read, J. C. (2019). Behavioral digital forensics model: Embedding behavioral evidence analysis into the investigation of digital crimes. Digital Investigation, 28, 70-82. https://doi.org/10.1016/j.diin.2018.12.003

Chetry, A., & Sharma, U. (2019, March). Memory forensics analysis for investigation of online crime-a review. In 2019 6th International Conference on Computing for Sustainable Global Development (INDIACom) (pp. 40-45). IEEE. https://ieeexplore.ieee.org/abstract/document/8991425

Mason, S., Sheldon, A., & Dries, H. (2015). Proof: the technical collection and examination of electronic evidence. https://www.jstor.org/stable/j.ctv512x65.16

Nikkel, B. (2020). Fintech forensics: Criminal investigation and digital evidence in financial technologies. Forensic Science International: Digital Investigation, 33, 200908. https://doi.org/10.1016/j.fsidi.2020.200908

Patil, A., Banerjee, S., Jadhav, D., & Borkar, G. (2022). Roadmap of Digital Forensics Investigation Process with Discovery of Tools. Cyber Security and Digital Forensics, 241-269. https://doi.org/10.1002/9781119795667.ch11

Wilson, N., Sheldon, A., Dries, H., Schafer, B., & Mason, S. (2021). Proof: the technical collection and examination of electronic evidence. In Electronic Evidence and Electronic Signatures (pp. 429-487). University of London Press. https://www.jstor.org/stable/pdf/j.ctv1vbd28p.16.pdf