Question

PART B: Five Short Answer Questions (25 marks) (Each question is worth 5 marks. Answer the questions in the Answer booklet provided.) Why is chain of custody important? What happens when a chain of custody is broken? Outline the basic steps when planning a digital forensics investigation [1+1+3 Marks] 1. Discuss two acquisition methods in digital forensics. Your answer should include scenarios and tools used in each acquisition method. [2+3 marks] 2 Why is validation important? What is data hiding? Discuss at least three data hiding techniques. [1+1+3 marks] 3. What are the main concerns with mobile phone data acquisition? What are the four categories of information that can be retrieved from a mobile phone? Describe the steps to analyse a mobile phone. [1+2+2 marks] 4.

Answer 1

Question 1

Chain of custody is important because it shows all the path which an investigator must follow so as to ensure that the data is an original one. It is one of the mandatory events that is required for the recording of the documentation for any chronological events. Last but not the least it plays an important part in gathering of all the digital evidence.

If the chain of custody is broken then the evidence becomes inadmissible to the corresponding court. Hence the evidence which have been collected becomes useless.

The basic steps which are required for planning a digital forensics investigation are as follows

a. First the time and the date limitations should be calculated

b. Secondly we have to identify which of the systems are affected

c. Note down the actions which have been followed after that

d. Chalk out the target and capture the required data.

e. The data should encrypted cryptographically

f. Analyzing the data and submitting it.

Question 2

Two Acquisition methods in digital forensics are as follows

a. Disk to Disk Copy

b. Disk to Image File

In disk to disk copy the required media is copied by bit for bit copy methods so that all the sectors are copied properly. It used the MD5 algorithm.

Disk to Image File it goes for a sector by sector copy and the image is stored in the format of DD or RAW. They use the hash detection technology so as to verify that the data has been copied properly.

Question 3

For an evidence or investigation Quality, safety, genuinely is important. Hence every evidence must be validated properly so that it serves the exact purpose.

Data hiding is a process where the techniques used makes it difficult for someone to find out a particular data easily whereas the necessary personnel can easily access it.

The different method of data hiding are

a. Steganography

b. Cryptography

c. Watermarking.