28. Introduction to Digital Forensics
28.2 Core Principles
Forensics che kahi niyam kadhihi modaayche nahit:
| Principle | Meaning |
|---|---|
| Preserve the original | Never work on the original device; it must not change |
| Work on a copy (image) | Make a bit-for-bit copy and examine that |
| Prove integrity with hashing | Hash the original and the copy; equal hashes prove nothing changed |
| Chain of custody | Document who handled the evidence, when, and why – every step |
| Use a write blocker | Hardware/software that lets you read a disk without writing to it |
| Document everything | Notes, timestamps, tools and versions, screenshots |
Hashing for integrity (you met hashing in Chapter 22): compute a hash of the evidence when you collect it; anyone can recompute it later and confirm the data is unchanged.
sha256sum evidence.dd # hash a disk image
sha256sum evidence.dd > evidence.dd.sha256 # record it
sha256sum -c evidence.dd.sha256 # later: verify it still matches
Ravindra Bagale's Tip
The biggest forensic mistake: working directly on the original device. Once you do anything on the live disk, the evidence changes and the court rejects it. Always: take an image, take a hash, and work on the copy. This one rule is the difference between a professional and an amateur.
Ravindra Bagale's Tip – मराठी
सर्वात मोठी forensic चूक: original device वर थेट काम करणे. एकदा तुम्ही live disk वर काही केले की पुरावा बदलतो आणि court तो नाकारते. नेहमी: image घ्या, hash घ्या, आणि copy वर काम करा. हा एकच नियम professional आणि amateur मधला फरक आहे.
Ravindra Bagale's Tip – हिंदी
सबसे बड़ी forensic गलती: original device पर सीधे काम करना. एक बार आपने live disk पर कुछ किया तो सबूत बदल जाता है और court उसे खारिज कर देता है. हमेशा: image लो, hash लो, और copy पर काम करो. यही एक नियम professional और amateur का फ़र्क है.
Practice task
Create a small file, compute its SHA-256, then change one character and hash again. Note how completely the hash changes – explain in one line why this proves integrity.