I'm new in forensics. I would like to understand the difference between evidence collection and data acquisition? How would you call the following events:
- Imaging the RAM on a live system;
- Retrieving logs from a running a web server;
-
1That depends on the purpose why you are doing this.– PhilippOct 11, 2015 at 17:33
Add a comment
|
2 Answers
As far as I know evidence is generally defined as
Any information of probative value that is either stored or transmitted in a digital form
Hence evidence is the information that can be used in the court of law to support your case.
When you acquire data from a source like logs or data files or images, you analyze it and find the if there is anything suspicious in there that will help your case in court. So when you ask
Imaging the RAM on a live system;
Retrieving logs from a running a webserver;
These are sources from where you acquire data to perform investigations. You look inside them and find something of credible value to help your case in court. If you find something that a malicious process was using the RAM then it becomes evidence. If you don't find anything in the log files you keep them in the case file regardless if it is of value or not. It's like real physical evidence. If blood stained bat with fingerprints is enough to prove the crime then there is no point presenting the footprint of a dog that you photographed during your visit to the crime scene just in case. These are technically the investigation team's property and is kept as evidence in their case file.
I hope you get the idea. :)
-
Thank you for your answer. This question was more related to vocabulary. I have seen these terms used some times interchangeably in books. IMHO, data acquisition is performed when you extract (image) data from devices like hard drives, usb keys, phones, .. I think about RAM imaging and log retrieval we can talk about live data collection. Once you get your data, you can start analysis. But that's just my opinion– OthmanOct 11, 2015 at 18:51
-
Exactly. I hope you understood the idea behind it. Glad to help. :) Oct 11, 2015 at 18:53
Evidence collection is actually collecting and gathering all the data you need to then use for data acquisition. Anything you can use that will help you gather data on whatever it is you're trying to use forensics techniques on. You then use all of that data you have collected to write up a well detailed report that can help be used to serve as the detailed report of the evidence gathered from imaging the ram and the logs on the server.
Also Caine 7.0 is a really good OS to download on a virtual machine to practice your forensics with. Any capture the flags involving computer forensics are really good practice.
