Forensic/data recovery good practice - Revision history

Admin at 01:49, 10 March 2025

2025-03-10T01:49:29Z

Admin at 21:11, 25 February 2025

2025-02-25T21:11:37Z

← Older revision		Revision as of 17:11, 25 February 2025
Line 132:		Line 132:
	<h2> Maintaining the validity of data within handled devices </h2>		<h2> Maintaining the validity of data within handled devices </h2>
	<h3> Contemporaneous notes </h3>		<h3> Contemporaneous notes </h3>
	Contemporaneous notes are a document which detail precisely what actions were taken(device imaged), how they were taken(device was imaged through Magnet axiom process).		Contemporaneous notes are a document which detail precisely what actions were taken(device imaged), how they were taken(device was imaged through Magnet axiom process).They are purely factal,
	<p> If you are making physical notes, it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased		<p> If you are making physical notes, it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased
	this allows you to prove that your notes were not changed at a later date. If you do make a mistake, simply strike through the mistake once, <B> Do not </B> attempt to scribe it out as it may look like your hiding something.		this allows you to prove that your notes were not changed at a later date. If you do make a mistake, simply strike through the mistake once, <B> Do not </B> attempt to scribe it out as it may look like your hiding something.
Line 138:		Line 138:
	By following those points, you ensure that any notes you have written can not be discredited because you may have edited them at a later date.		By following those points, you ensure that any notes you have written can not be discredited because you may have edited them at a later date.
	</br>		</br>
			Contemporaneous notes should consist of the follow things:
			<ul>
			<li> Case reference number - To indenify what case these notes belong to</li>
			<li> Exhibt reference number - To indeify what exhibit within the case the notes are referring too.</li>
			<li> Type of examination - What was conducted, was the device imaged?, was it repaired?, was it examined?</li>
			<li> Full name of the examiner - Full name helps elimate confusion.</li>
			<li> Start date and time - When was the Examination started(format: 13:01:07 11/OCT/2025) </li>
			<li> Examination processes and results- Include any notes, but detail at what exect actions you took,when you took them and how you did them.(the time the action was taken or as soon as reasonible possible</br>
			its better to be unsure than to make something up or guess.</li>
			<li> End date and time - When was the Examination ended(format: 13:01:07 11/OCT/2025) </li>
			<li> signture of the examiner - By signing the note you are providing proof it was you(be aware these notes could be made public record) </li>
			</ul>
			Photographs count as part of comtemporaneous notes but make sure the conetents of the image is discribe in detail</br>
			For example:</br>
			Photograph of Blue Iphone 5 se with a black logo of a apple located in the center of the phones case scratch running diconally across the back of the phone from top to bottom.
			The phone is resting on the bedside cabinet</br> Where it was found upon its discovery. There is no other noticable markings on the phone besides the standard serial number 1238414114 and the IMEI number 41747134
	<h3> Chain of custody(COC) </h3>		<h3> Chain of custody(COC) </h3>
	Consider chain of custody like parcel tracking information it allows a person/s to know when, where and with who an exhibit (piece of evidence) has been all the way from seizure from the crime scene till the exhibit is destroyed.</br> COC is used to ensure that an exhibit is not tampered with at all alongside other methods such as storing the exhibit with a ISO 27025 compliant storage room. If an exhibit is tampered with or a claim is made stating that, then/br> it is possible to trace back until the responsible party is located, or a mistake is identified.</br>		Consider chain of custody like parcel tracking information it allows a person/s to know when, where and with who an exhibit (piece of evidence) has been all the way from seizure from the crime scene till the exhibit is destroyed.</br> COC is used to ensure that an exhibit is not tampered with at all alongside other methods such as storing the exhibit with a ISO 27025 compliant storage room. If an exhibit is tampered with or a claim is made stating that, then/br> it is possible to trace back until the responsible party is located, or a mistake is identified.</br>
	A COC form should consist of at least the following.		A COC form should consist of at least the following:
	<ul>		<ul>
	<li>Name and signature of person/s who are gaining access to the exhibit</li>		<li>Name and signature of person/s who are gaining access to the exhibit</li>

Admin at 19:22, 25 February 2025

2025-02-25T19:22:27Z

← Older revision		Revision as of 15:22, 25 February 2025
Line 131:		Line 131:

	<h2> Maintaining the validity of data within handled devices </h2>		<h2> Maintaining the validity of data within handled devices </h2>
	<h3> ~~contemporaneous~~ notes </h3>		<h3> Contemporaneous notes </h3>
			Contemporaneous notes are a document which detail precisely what actions were taken(device imaged), how they were taken(device was imaged through Magnet axiom process).
	<p> If you are making physical notes, it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased		<p> If you are making physical notes, it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased
	this allows you to prove that your notes were not changed at a later date. If you do make a mistake, simply strike through the mistake once, <B> Do not </B> attempt to scribe it out as it may look like your hiding something.		this allows you to prove that your notes were not changed at a later date. If you do make a mistake, simply strike through the mistake once, <B> Do not </B> attempt to scribe it out as it may look like your hiding something.

Admin at 19:16, 25 February 2025

2025-02-25T19:16:54Z

← Older revision		Revision as of 15:16, 25 February 2025
Line 138:		Line 138:
	</br>		</br>
	<h3> Chain of custody(COC) </h3>		<h3> Chain of custody(COC) </h3>
	Consider chain of custody like parcel tracking information it allows a person/s to know when, where and with who a exhibit(piece of evidence) has been all the way from seizure from the crime scene till ~~its presented~~ as a exhibit ~~in court~~.</br>		Consider chain of custody like parcel tracking information it allows a person/s to know when, where and with who an exhibit (piece of evidence) has been all the way from seizure from the crime scene till the exhibit is destroyed.</br> COC is used to ensure that an exhibit is not tampered with at all alongside other methods such as storing the exhibit with a ISO 27025 compliant storage room. If an exhibit is tampered with or a claim is made stating that, then/br> it is possible to trace back until the responsible party is located, or a mistake is identified.</br>
			A COC form should consist of at least the following.
			<ul>
			<li>Name and signature of person/s who are gaining access to the exhibit</li>
			<li>Location - where the exhibit was kept</li>
			<li>Access log - which people could physically access the exhibit</li>
			<li>Activities - What happened either with or to the exhibit</li>
			<li>Date and time of access - What time and date was the exhibit access (01/Oct/25)</li>
			<li>Reason for access - Why do did you need to physically access the exhibit(e.g. imaging the device)</li>
			<li>Case Reference number - The reference number of the case the exhibit is a part of</li>
			<li> bag seal number - The unique number of the evidence bag the exhibit is stored in</li>
			</ul>
	<expand>		<expand>
	<h3> ACPO principles </h3>		<h3> ACPO principles </h3>
Line 167:		Line 178:
	the law and these principles are adhered to.</li>		the law and these principles are adhered to.</li>
	Explanation: It is the responsible of the person in charge (manager, lead investigator) to make sure everyone part of the investigation follows these principles and the laws regarding investigations and evidence handling.		Explanation: It is the responsible of the person in charge (manager, lead investigator) to make sure everyone part of the investigation follows these principles and the laws regarding investigations and evidence handling.

	~~<h2>Evidence logs</h2>~~
	~~<h2>Examiners checklist</h2>~~

	</p>		</p>
Line 184:		Line 192:
	<div class="reference-list">		<div class="reference-list">
	<ol>		<ol>
	<li>Reference 1: <a href="https://archive.org/details/forensicsfordumm0000lyle_i4z6">Forensics for dummies page 49-50(chain of custody</a></li>		<li>Reference 1: <a href="https://archive.org/details/forensicsfordumm0000lyle_i4z6">Forensics for dummies page 49-50(chain of custody)</a></li>
	<li>Reference 2: <a href="https://web.archive.org/web/20240912033946/https://library.college.police.uk/docs/acpo/digital-evidence-2012.pdf">ACPO principles (section 2.1)</a></li>		<li>Reference 2: <a href="https://web.archive.org/web/20240912033946/https://library.college.police.uk/docs/acpo/digital-evidence-2012.pdf">ACPO principles (section 2.1)</a></li>
	</ol>		</ol>

Admin at 11:50, 25 February 2025

2025-02-25T11:50:22Z

← Older revision		Revision as of 07:50, 25 February 2025
Line 138:		Line 138:
	</br>		</br>
	<h3> Chain of custody(COC) </h3>		<h3> Chain of custody(COC) </h3>
			Consider chain of custody like parcel tracking information it allows a person/s to know when, where and with who a exhibit(piece of evidence) has been all the way from seizure from the crime scene till its presented as a exhibit in court.</br>
			<expand>
	<h3> ACPO principles </h3>		<h3> ACPO principles </h3>
	<ul>		<ul>
Line 166:		Line 167:
	the law and these principles are adhered to.</li>		the law and these principles are adhered to.</li>
	Explanation: It is the responsible of the person in charge (manager, lead investigator) to make sure everyone part of the investigation follows these principles and the laws regarding investigations and evidence handling.		Explanation: It is the responsible of the person in charge (manager, lead investigator) to make sure everyone part of the investigation follows these principles and the laws regarding investigations and evidence handling.

			<h2>Evidence logs</h2>
			<h2>Examiners checklist</h2>

	</p>		</p>

	<h1 id="section5">Related Topics</h1>		<h1 id="section5">Related Topics</h1>
	<p>Topics such as desoldering to chip off or firmware dumping for disk PCB repairs</p>		<p>Topics such as desoldering to chip off or firmware dumping for disk PCB repairs</p>

Admin at 02:32, 25 February 2025

2025-02-25T02:32:14Z

← Older revision		Revision as of 22:32, 24 February 2025
Line 137:		Line 137:
	By following those points, you ensure that any notes you have written can not be discredited because you may have edited them at a later date.		By following those points, you ensure that any notes you have written can not be discredited because you may have edited them at a later date.
	</br>		</br>
	<h3> Chain of custody </h3>		<h3> Chain of custody(COC) </h3>

	<h3> ACPO principles </h3>		<h3> ACPO principles </h3>

Admin at 02:10, 25 February 2025

2025-02-25T02:10:21Z

← Older revision		Revision as of 22:10, 24 February 2025
Line 130:		Line 130:
	That is how you create truly capable, truly independent individuals in what ever aspect of life you find your self. The foundation of that is building good practices.<br>		That is how you create truly capable, truly independent individuals in what ever aspect of life you find your self. The foundation of that is building good practices.<br>

	<h2> ~~maintaining~~ the validity of data within handled devices </h2>		<h2> Maintaining the validity of data within handled devices </h2>
	<h3> contemporaneous notes </h3>		<h3> contemporaneous notes </h3>
	<p> If you are making physical notes, it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased		<p> If you are making physical notes, it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased

Admin at 02:09, 25 February 2025

2025-02-25T02:09:59Z

← Older revision		Revision as of 22:09, 24 February 2025
Line 125:		Line 125:
	<br>		<br>
	They often do not cover the skills to problem-solve and build up the confidence to take an unknown project with no or limited experience.		They often do not cover the skills to problem-solve and build up the confidence to take an unknown project with no or limited experience.
	That is the ultimate goal of the course is to provide people with the confidence to try skills, and not be affarid of failure because ~~its~~ a natural part of learning.		That is the ultimate goal of the course is to provide people with the confidence to try skills, and not be affarid of failure because it's a natural part of learning.
	<br>		<br>
	<br>		<br>
	That is how you create truly capable, truly independent individuals in what ever aspect of life you find your self. The foundation of that is building good practices.<br>		That is how you create truly capable, truly independent individuals in what ever aspect of life you find your self. The foundation of that is building good practices.<br>
	</p>
	<p> If you are making physical notes it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased		<h2> maintaining the validity of data within handled devices </h2>
			<h3> contemporaneous notes </h3>
			<p> If you are making physical notes, it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased
	this allows you to prove that your notes were not changed at a later date. If you do make a mistake, simply strike through the mistake once, <B> Do not </B> attempt to scribe it out as it may look like your hiding something.		this allows you to prove that your notes were not changed at a later date. If you do make a mistake, simply strike through the mistake once, <B> Do not </B> attempt to scribe it out as it may look like your hiding something.
	<br>		<br>
	By following those points, you ensure that any notes you have written can not be discredited because you may have edited them at a later date.		By following those points, you ensure that any notes you have written can not be discredited because you may have edited them at a later date.
			</br>
			<h3> Chain of custody </h3>

			<h3> ACPO principles </h3>
			<ul>
			<li> Principle 1: No action taken by law enforcement agencies, persons employed within those agencies
			or their agents should change data which may subsequently be relied upon in court.</li>
			Explanation: Nobody who works either for or on behalf of law enforcement agencies (police, government or people contracted to preform a role by the agencies)</br>
			should change any data either from or still on a device, which maybe used as part of a case in a court.

			<li> Principle 2: In circumstances where a person finds it necessary to access original data, that person
			must be competent to do so and be able to give evidence explaining the relevance and the
			implications of their actions.</li>
			Explanation: While principle 2 says you should never ever change data that will be used in court. It is okay (access logs from access images on a device for example, not planting evidence.)
			</b> if there is no other way to access data, on a device <b> BUT </b> the person doing it needs to <b> know </b> what there doing and be able to <b> explain </b> what they did, what affects</br>
			their actions had on the device (what data changed) and why it was absolutely necessary it was done this way(e.g. there was no other viable option to retrieve the data>.

			<li>Principle 3: An audit trail or other record of all processes applied to digital evidence should be
			created and preserved. An independent third party should be able to examine those processes and
			achieve the same result.</li>
			Explanation: Make notes of everything, how it was done, what was done, what was it done on (software, version numbers and hardware). When it was done</br>
			The goal is for another person to be able to recreate the exact results using only your notes (not including how to instructions) it is assumed and hoped the person is competent.


			The standard date formatting for the UK is as follows, 11/OCT/2025) this clearly shows it was done on the 11th of October (11/10/25) and not the 10th of November (10/11/25)</br>
			this practice helps avoid mistakes as different parts of the world use different data formats.

			<li>Principle 4: The person in charge of the investigation has overall responsibility for ensuring that
			the law and these principles are adhered to.</li>
			Explanation: It is the responsible of the person in charge (manager, lead investigator) to make sure everyone part of the investigation follows these principles and the laws regarding investigations and evidence handling.
			</p>
	<h1 id="section5">Related Topics</h1>		<h1 id="section5">Related Topics</h1>
	<p>Topics such as desoldering to chip off or firmware dumping for disk PCB repairs</p>		<p>Topics such as desoldering to chip off or firmware dumping for disk PCB repairs</p>
Line 146:		Line 179:
	<ol>		<ol>
	<li>Reference 1: <a href="https://archive.org/details/forensicsfordumm0000lyle_i4z6">Forensics for dummies page 49-50(chain of custody</a></li>		<li>Reference 1: <a href="https://archive.org/details/forensicsfordumm0000lyle_i4z6">Forensics for dummies page 49-50(chain of custody</a></li>
	<li>Reference 2: <a href="#">~~Source details~~</a></li>		<li>Reference 2: <a href="https://web.archive.org/web/20240912033946/https://library.college.police.uk/docs/acpo/digital-evidence-2012.pdf">ACPO principles (section 2.1)</a></li>
	</ol>		</ol>
	</div>		</div>

Admin at 13:33, 20 February 2025

2025-02-20T13:33:05Z

← Older revision		Revision as of 09:33, 20 February 2025
Line 145:		Line 145:
	<div class="reference-list">		<div class="reference-list">
	<ol>		<ol>
	<li>Reference 1: <a href="#">~~Source details~~</a></li>		<li>Reference 1: <a href="https://archive.org/details/forensicsfordumm0000lyle_i4z6">Forensics for dummies page 49-50(chain of custody</a></li>
	<li>Reference 2: <a href="#">Source details</a></li>		<li>Reference 2: <a href="#">Source details</a></li>
	</ol>		</ol>

Admin at 20:55, 23 December 2024

2024-12-23T20:55:00Z

← Older revision		Revision as of 16:55, 23 December 2024
Line 130:		Line 130:
	That is how you create truly capable, truly independent individuals in what ever aspect of life you find your self. The foundation of that is building good practices.<br>		That is how you create truly capable, truly independent individuals in what ever aspect of life you find your self. The foundation of that is building good practices.<br>
	</p>		</p>
			<p> If you are making physical notes it is <B> critically important</B> that the page is signed and dated with any blank space having a singular link running through the middle of it while using a pen which can not be erased
			this allows you to prove that your notes were not changed at a later date. If you do make a mistake, simply strike through the mistake once, <B> Do not </B> attempt to scribe it out as it may look like your hiding something.
			<br>
			By following those points, you ensure that any notes you have written can not be discredited because you may have edited them at a later date.
	<h1 id="section5">Related Topics</h1>		<h1 id="section5">Related Topics</h1>
	<p>Topics such as desoldering to chip off or firmware dumping for disk PCB repairs</p>		<p>Topics such as desoldering to chip off or firmware dumping for disk PCB repairs</p>