Mobile Digital Evidence And Forensics

E Radar Mobile Enterprise Summit

Mobile Digital Evidence

http://farm2.static.flickr.com/1099/3167026024_cfbcf178e2.jpg

cy4or.co.uk 3 March 2014

Agenda

Understanding the goals of forensic readiness

Magnitude of information

Preservation of evidence



Understanding the goals of

forensic readiness



To gather admissible evidence legally and without interfering

with business processes



To gather evidence targeting the potential crimes and

disputes that may adversely impact the organisation



To allow an investigation to proceed at a cost in proportion

to the incident



To minimise interruption to the business from any

investigation and to ensure that evidence makes a positive impact on the outcome of any

legal action



The magnitude of information



• A4 sheet with 1” margin contains 3600 characters at 12pt

• 500sheets of A4 80gsm = 2.25”• 500 x 3600 = 1.8M bytes• ~1Mbytes = 1.25” (2.25/1.8)• 40GB = 4,166ft high (40x1000x1.25”)

1062

.9 f

eet



‘Big Data’

Every time we travel with smartphones, make card

purchases online and use social media we contribute to 'big data'



Where is data stored?



EDRM

Source: www.edrm.net

http://www.edrm.net/



Preservation of evidence



Detecting computer misuse



What is digital evidence?



Incident response – do’s and don’ts



Thank you for your timeAny questions?

www.cy4or.co.uk www.cy4or.co.uk/news

[email protected]



Mobile Digital Evidence And Forensics

Technology

admissible evidence

big dataevery time

sheets of a4

positive impact

feet a4 sheet

card purchases

social media

ft high 40x1000x1