Digital forensics has had my attention for well over 13 years. Ever since I was given my first PC (thanks, Mom and Dad), I've always wondered what happened when I deleted my files from my massively large 2 GB hard drive or moved (and most times hid) my files to a less-than-inconspicuous 3.5-inch floppy diskette which maxed out at 1.44 MB (Megabytes) in capacity.
As I soon learned, hard disk drives and floppy disk drives did not possess the digital immortality I so confidently believed in. Sadly, many files, documents, and priceless fine art created in Microsoft Paint by yours truly were lost to the digital afterlife, never to be retrieved again. Sigh. The world shall never know.
It wasn't until years later that I came across an article on file recovery and associated tools while browsing the magical World Wide Web (WWW) on my lightning-fast 42 Kbps dial-up internet connection (made possible by my very expensive USRobotics dial-up modem), which sang the tune of the technology gods every time I'd try to connect to the realm of the internet. This process involved a stealthy ninja-like skill that would make even a black-ops team envious, as it involved doing so without my parents noticing, as this would prevent them from using the telephone line to make or receive phone calls. (Apologies dear Mother, Father, and older teenage sister).
The previous article on data recovery wasn't anywhere near as detailed and fact-filled as the many great peer-reviewed papers, journals, and books on digital forensics widely-available today. As a total novice (also referred to as a noob) in the field, I did learn a great deal about the basics of file systems, data and metadata, storage measurements, and the workings of various storage media.
It was at this time that, even though I had read about the Linux operating system and its various distributions (or distros), I began to get an understanding of why Linux distros were popular in data recovery and forensics.
At this time, I managed to bravely download the Auditor and Slax Linux distributions, again on a dial-up connection. Just downloading these operating systems was quite a feat, which left me feeling highly accomplished as I did not have any clue as to how to install them, let alone actually use them. In those days, easy-installation and GUIs were still under heavy development, as user friendly, or in my case, user unfriendly, as they were at the time (mostly due to my inexperience, lack of recommended hardware, and also lack of resources such as online forums, blogs, and YouTube...which I did not yet know about). I'll explain more about the Auditor and Slax operating systems in Chapter 2, Installing Kali Linux, including their role in the infamous BackTrack, and now Kali Linux, operating systems.
As time passed, I researched many tools found on various platforms for Windows, Macintosh, and many Linux distributions. I found that many of the tools used in digital forensics could be installed in various Linux distributions or flavors and many of these tools were well maintained, constantly being developed and were widely accepted by peers in the field. Kali Linux is a Linux distribution or flavor, but before we go any further, let me explain the concept of Linux distribution or flavor. Consider your favorite beverage: this beverage can come in many flavors, some without sweeteners or sugar, in different colors, and even in various sizes. No matter what the variations, it's still the basic ingredients that comprise the beverage, at the core. In this way, too, we have Linux, and then different types and varieties of Linux. Some more popular Linux distros and flavors include RedHat, CentOS, Ubuntu, Mint, Knoppix, and, of course, Kali Linux. More on Kali Linux will be discussed in Chapter 2, Installing Kali Linux.
For this book, we take a very structured approach to digital forensics, as we would in forensic science. We first stroll into the world of digital forensics, its history, some of the tools and operating systems used for forensics, and immediately introduce you to the concepts involved in evidence preservation.
How about we kick things off. Let's get started!
This chapter gives an introduction to the various aspects of the science of digital forensics.
The topics we are going to cover in this chapter are:
- What is digital forensics?
- Digital forensics methodology.
- A brief history of digital forensics.
- The need for digital forensics as technology advances.
- Anti-forensics: threats to digital forensics
- Commercial tools available in the field of digital forensics.
- Open source tools.
- Operating systems with built-in tools for digital forensics.
- The need for using multiple forensics tools in investigations in an effort to provide strong proof of integrity.