Title: 3. Validating Forensic Data
Course: IN 2005 Digital Forensics > Section: Module 9: Chapter 9 - Computer Forensics Analysis and Validation

Validating Forensic Data

1. Validating digital evidence is one of the most critical aspects of computer forensics because ensuring the integrity of data you collect is essential for presenting evidence in court.
2. Most computer forensic tools provide automated hashing of image files.  Computer forensics tools have some limitations in performing hashing, so learning how to use advanced hexadecimal editors is necessary to ensure data integrity.

Validating with Hexadecimal Editors

1. Advanced hexadecimal editors offer many features not available in computer forensics tools, such as hashing specific files or sectors.
2. Hex Workshop provides several hashing algorithms, such as MD5 and SHA-1.  Hex Workshop also generates the hash value of selected data sets in a file or sector.  See Figures 9-4 through 9-6.
3. AccessData has a separate database, the Known File Filter (KFF).  KFF filters known program files from view, such as MSWord.exe, and identifies known illegal files, such as child pornography.
4. KFF compares known file hash values to files on your evidence drive or image files.
5. Periodically, AccessData updates these known file hash values and posts an updated KFF.

Validating with Computer Forensics Programs

1. Commercial computer forensics programs have built-in validation features.
2. ProDiscover’s .eve files contain metadata that includes the hash value and data validation is done automatically. Raw format image files (.dd extension) don’t contain metadata, so you must validate raw format image files manually to ensure the integrity of data.
3. In AccessData FTK Imager, when you select the Expert Witness (.e01) or the SMART (.s01) format, additional options for validating the acquisition are displayed.  This validation report also lists MD5 and SHA-1 hash values.
4. See Figure 9-7 to view how ProDiscover’s built-in validation feature works.