There is no substitute for the mastery of this material. Our responsibilities as an expert witness include explaining technical subject matter in a way that the average person is able to understand.

How do bytes relate to letters and numbers? Each letter, number, space, and special character is represented by a single byte. For example, using the ASCII character set 01000001 represents an uppercase “A,” while a lowercase “a” is 01100001.

Let’s do a little experiment so you can see this in action. Open a new text document (using a Plain Text editor, not a word processing application like Microsoft Word) on your computer and type the phrase “Marshall University Digital Forensics.” Now, count all the letters and spaces. Next, save and close the new text file to your desktop. Right-click on the file and select properties. What’s the file size? It should be 26 bytes, which is also the exact number of letters and spaces.

To get a broader perspective, let’s look at all of the binary necessary to represent our sample phrase “Marshall University Digital Forensics”:

At first glance, that’s a little tough to read, no doubt. Fortunately, there is a shorthand that we can use to make this more readable. This shorthand is called hexadecimal.

For our purposes, a file extension isn’t the most reliable way to identify a given file. The file extension is very easily changed, requiring only a mouse click and a couple of keystrokes. You can try this yourself. In Windows, simply right-click on a file name and rename it, changing the extension. Let’s say we change the extension of a Word file to that of an image—JPEG, for example. This is easily accomplished. On a Windows machine, simply click, pause for a moment, and click again. On a Mac, it’s click+Return. What happens when we try to open that file? Nothing. It won’t open. Change it back and it opens right up.

Some people will attempt to take advantage of this ability to change file extensions as a way to conceal data, hiding them in plain sight. Forensically, this approach is not very effective. Forensic tools identify files based on the header, not the file extension. Many tools will even separate out those files whose headers do not match their extensions, making them easily discovered. This comparison is generally known as file signature analysis. Figures 2.1 and 2.2 illustrate what happens when a file extension is changed.

Environments can be broken down into four categories: stand alone, networked, mainframe, and the cloud.

A stand-alone computer is one that is not connected to another computer. These are the easiest to deal with and investigate. Possible locations for evidence are reasonably confined. Stand-alone systems are routinely encountered in residences such as apartments and houses.

A networked computer is connected to at least one other computer and potentially many, many others. This escalates the complexity as well as the places evidence could be found. We now can see files and artifacts normally found on the local machine spread out to servers or other machines. This environment introduces a variety of variables into the equation. Even though networks are more commonly found in a business setting, they are found more and more in homes.

Unlike a stand-alone machine, a mainframe system centralizes all of the computing power into one location. Processors, storage, and applications can all be located and controlled from a single location.

There are many different types of file systems. Some of the most commonly encountered by forensic examiners include FAT, NTFS, and HFS+. Let’s take a closer look:

While a sector is the smallest container of data, a computer’s operating system only stores data as clusters. Clusters are comprised of multiple sectors. In this example, our clusters contain four sectors. Each sector can hold up to 512 bytes of data, giving the clusters the storage capacity of 2,048 bytes. See Figure 2.5.

It’s important to remember that computers write data to the drive in clusters. If the file is larger than a single cluster, the system assigns it an additional cluster even though a portion of that cluster may not be used. Let’s work through a little hypothetical exercise to better illustrate this concept.

Suppose we save our master criminal plan to our hard drive. We’ll call it “evidence1.doc.” It just so happens to be 2,304 bytes in size. Since it’s larger than our cluster size limit (2,048 bytes), it’s assigned to two separate, unallocated clusters (in this example, clusters 5,245 and 5,246). You’ll also notice that our file only uses a portion of the first sector in the second cluster. Since the machine has to write 512 bytes at a time, it fills that leftover space with zeros. See Figure 2.6.

What about the last three sectors in cluster 5,246 that weren’t used? The answer is nothing. As we’ll see in just a bit, this system behavior can leave some evidence behind. See Figure 2.7.

After watching Abby and McGee work their magic on NCIS, we start to have second thoughts. We decide it’s probably better not to have that file on our computer. So we hit the delete key, sending evidence1.doc to the recycle bin. With a sly grin, we empty the recycle bin, happy in the belief that evidence1.doc is now residing in digital oblivion. But wait—not so fast. The problem for us as bad guys is that, unbeknownst to us, our incriminating file is still on the drive. It will remain in those two clusters until it’s been overwritten by another file. Given the size of today’s drives, that could take a very, very long time. Using standard forensic tools, forensics examiners can recover any part of the document that hasn’t been overwritten. Figure 2.8 depicts our two clusters after the recycle bin has been emptied.

Now for some really cool forensic stuff. Even if the clusters containing our evidence are allocated to another file, all is not lost for examiners. It’s still possible to extract a portion of the original file. Here’s how it works. Two days later, we save another file to our drive. We’ll call this one “evidence2.doc.” It’s only 768 bytes in size, so it only takes one cluster to hold it. The system sees that cluster 5,245 is available and decides to put it there. Remember, evidence1.doc is still sitting in the cluster even though it’s been “deleted.” The system writes evidence2.doc to the first sector and part of the second. It then does its normal thing and fills the remainder of that second sector with zeros. What happens to the rest of evidence1.doc? When we first saved it, it took up all of cluster 5,245. Our new file (evidence2.doc) has overwritten only part of evidence1.doc. The remnants of evidence1.doc that sit in the last two sectors can be recovered! See Figure 2.9.

To recap, only the first 780 bytes of our original file have been overwritten. Some quick math tells us that there are still 244 bytes of our original file remaining. Those 244 remaining bytes comprise what’s known as slack space. The slack space, depicted in Figure 2.10, is the difference between the space that is assigned and the space that is actually used.

So, out of the slack space, we can recover fragments of the previous file. That data may not be useful. But then again, it just might be. It could be part of an incriminating spreadsheet, e-mail, or picture. These fragments could contain just enough of an e-mail to identify the sender or the sender’s IP address. A partial picture of the victim could link them to the suspect. Slack space can’t be accessed by the user or the operating system. As such, this evidence exists unbeknownst to all but the most tech-savvy suspects.

Unfortunately, recovering evidence from slack space may very well become a thing of the past. We’ll explore that bad news more in Chapter Eleven, “Looking Ahead: Challenges and Concerns.”

In contrast, storage is used for the long-term storing of data. Storage is considered nonvolatile because the data remains even if the device loses power. Your hard drive is an example of storage.

A computer’s file system is at the heart of how it saves and retrieves data. File systems keep track of the various pieces of data that must be found and reconstituted to open a file. There are multiple file systems in use today, each with its own way doing things.

Not all computing environments are the same. Some are relatively simple, others much more complex. Stand-alone computers, networks, and the cloud were covered in this chapter.

As forensic examiners, we must have command of this material so we can explain it to the average person. It is these “average people” who make up our juries.