Day 22 - May 22 - Happy Sherlock Holmes Day!
- Elizabeth Rasnick
- May 24, 2023
- 2 min read
Today is Sir Arthur Conan Doyle’s birthday and so is recognized as Sherlock Holmes Day in his honor. This gives us a great reason to talk about digital forensics. In the Victorian Era, Scotland Yard, key player in so many Holmes cases, developed the use of fingerprints. Scotland Yard’s forward-thinking breakthrough is now considered common practice. That work set the stage for today’s digital investigations.
People have digital fingerprints. Just as physical fingerprints match to a specific person, we each have a unique digital fingerprint. Our digital fingerprints include things like the type of sites we visit, how long we stay on them, when we visit them, how we access them, and the location from which we access sites. The collection of this data is specific to the user and acts as our digital fingerprint. Some digital forensic analysts specialize in understanding how we make and how to trace our digital fingerprints.
Other digital forensics examiners painstakingly comb through digital media looking for illicit material. This content could be pornography, records of drug transactions, and human trafficking network information, and the like. Criminals frequently try to hide this data and the media on which it is stored. Unconventional hiding places, like gaming stations, have been found loaded with criminal data. Hard drives have been found in flower beds or toilet tanks. To fight such tactics, digital forensic investigators have been as innovative as 19th century Scotland Yard. They have developed an entire toolkit including specially trained dogs that can sniff out digital media. These dogs are trained in a similar fashion to other dogs used for scent-tracking, but instead of being trained on the scents of drugs or cadavers, they are trained on digital media.
Do you remember on Day 13 that I mentioned deleted does not mean gone forever? Here it is, again. Once all these hard drives, disks, and other media have been located, the files are restored, even if the drives have been wiped clean or had junk files written on them in an effort to obfuscate the real data. File fragments will be present and the data is recoverable using those fragments.
Social network analysis is now being used to locate criminals that have gone into hiding. Even if they use a pseudonym, by looking at the interactions of their known associates and family members, it is possible to identify many of them. Keep in mind the idea of six degrees of separation that I mentioned on Day 15 (Social Networks). If a new person appears within a well-established network at the same time a known criminal disappears, the chances are high that the missing criminal has been located.
Comments