Handbook of Digital Forensics of Multimedia Data and Devices

Anthony T. S. Ho, Shujun Li, Anthony T. S. Ho, Shujun Li

• Publisher: Wiley-IEEE Press
• Year: 2015
• Print ISBN: 9781118640500
• eBook ISBN: 9781118705797
• Edition: 1
• Topic: Technology & Engineering
• Subtopic: Signals & Signal Processing
• Index: Technology & Engineering

Digital forensics and multimedia forensics are rapidly growing disciplines whereby electronic information is extracted and interpreted for use in a court of law. These two fields are finding increasing importance in law enforcement and the investigation of cybercrime as the ubiquity of personal computing and the internet becomes ever-more apparent. Digital forensics involves investigating computer systems and digital artefacts in general, while multimedia forensics is a sub-topic of digital forensics focusing on evidence extracted from both normal computer systems and special multimedia devices, such as digital cameras.

This book focuses on the interface between digital forensics and multimedia forensics, bringing two closely related fields of forensic expertise together to identify and understand the current state-of-the-art in digital forensic investigation. Both fields are expertly attended to by contributions from researchers and forensic practitioners specializing in diverse topics such as forensic authentication, forensic triage, forensic photogrammetry, biometric forensics, multimedia device identification, and image forgery detection among many others.

Key features:

• Brings digital and multimedia forensics together with contributions from academia, law enforcement, and the digital forensics industry for extensive coverage of all the major aspects of digital forensics of multimedia data and devices
• Provides comprehensive and authoritative coverage of digital forensics of multimedia data and devices
• Offers not only explanations of techniques but also real-world and simulated case studies to illustrate how digital and multimedia forensics techniques work
• Includes a companion website hosting continually updated supplementary materials ranging from extended and updated coverage of standards to best practice guides, test datasets and more case studies

Part One
Multimedia Evidence Handling

1
Digital Forensics Laboratories in Operation: How Are Multimedia Data and Devices Handled?

Shujun Li and Anthony T.S. Ho

Department of Computing and Surrey Centre for Cyber Security (SCCS), University of Surrey, Guildford, UK

1.1 Introduction

This chapter looks at the operational side of digital forensics of multimedia data and devices in real-world digital forensics laboratories, especially those run by law enforcement, in order to prepare readers with a proper background for different technical aspects covered in other chapters of this book. The chapter can also be read alone to gain insights about the operational aspect of digital forensic services and practices on multimedia data and devices.

While most digital forensics laboratories handle multimedia data and devices in their everyday operation, the forensic procedures, techniques and tools used often differ from each other due to many factors such as different legislations regulating forensic practices, different digital forensic standards and best practices followed, different structures of the digital forensics laboratories and their parent bodies, etc. We realized that it is difficult to cover too many digital forensics laboratories in different countries in such a short book chapter, so we decide to focus on the following three representative laboratories (two in the United Kingdom and one in China):

• Digital and Electronics Forensic Service (DEFS), Metropolitan Police Service (known as “the Met” or “the Met Police”, the largest territorial police force in the United Kingdom responsible for policing Greater London excluding the City of London Police area),
• Digital Forensics Team (including an affiliated Audio-Video Team, AV Team), Surrey Police (a medium-sized territorial police force responsible for policing the county of Surrey in the United Kingdom),
• Shanghai Stars Digital Forensic Center (SSDFC), Third Research Institute, Ministry of Public Security, China.

Among the three digital forensics laboratories listed, the Met’s DEFS is the largest one with around 70 technical staff members. The other two are smaller in size but still have a considerably large team (with 14 and 32 technical staff members, respectively). Covering digital forensics laboratories of different sizes highlights how forensic practices of large and smaller law enforcement agencies differ from each other. The third digital forensics laboratory in the list is not an in-house team of a police force, but part of a research institute of the central police authority (Ministry of Public Security) in China. It was selected to cover a different type of digital forensic service providers and also digital forensic practices in a major legislation significantly different from the UK system and the Western systems as a whole. We have not opted to cover any private sector digital forensic service providers because the quality and scope of their services are much more diverse and may not be directly comparable with those provided by law enforcement bodies.

The rest of this chapter is organized as follows. Section 1.2 describes how multimedia data and devices are handled at the Met’s DEFS, with a particular focus on the DEFS’s AV Laboratory (AV Lab) which is the main forensic laboratory handling multimedia data and devices. Sections 1.3 and 1.4 describe different aspects of digital forensic practices on multimedia data and devices at the Digital Forensics Team (including the affiliated AV Team) of Surrey Police (UK) and at the Shanghai Stars Digital Forensic Center (China), respectively. After describing the three digital forensics laboratories, Section 1.5 compares digital forensics practices of the three laboratories to show common features and major differences, which lead to some key observations for future research and possible extension of this chapter. The last section briefly summarizes this chapter. An appendix is given to cover the questions that we asked during our interviews with Surrey Police and the Shanghai Stars Digital Forensic Center in China.

1.2 Digital and Electronics Forensic Service, Metropolitan Police Service, UK

The information about the Digital and Electronics Forensic Service (DEFS) of the Metropolitan Police Service was obtained through a written document provided by staff members of the DEFS. The document was not guided by the authors of the chapter, but is more a systematic summary from DEFS staff’s point of view on different aspects of their digital forensic practices with a special focus on multimedia data and devices. Further e-mail communications took place after the authors received the written document to clarify unclear issues. The published content of this section was reviewed by the informants.

1.2.1. Background: Metropolitan Police Service

The Metropolitan Police Service (“the Met” hereinafter) is the largest police force in the United Kingdom with around 31 000 police officers, 13 000 police staff, 2 600 Police Community Support Officers (PCSOs) and 5 100 special constables (volunteer police officers) as of May 2014 (Metropolitan Police Service 2014a). It was established in 1829 after the first Metropolitan Police Act was passed (UK Parliament 1829). It is responsible for law enforcement in Greater London (excluding the small region called ‘City of London’ which is the responsibility of the City of London Police), covering a population of 7.2 million (Metropolitan Police Service 2014a). According to the statistics published on its website (Metropolitan Police Service 2014b), there were in total 771 566 notifiable offences in 2012-2013 fiscal year.

1.2.2 Digital and Electronics Forensic Service

The DEFS hereinafter provides the Met with in-house facilities and outsourced services to examine today’s high-tech electronic data and devices. It provides a comprehensive range of services at one location, in its AV, computer, and telephone laboratories. Each of the three laboratories has around 20 members of technical staff. There is also a smaller laboratory for cell site analysis, which has five members of staff. In 2013 the DEFS handled 2 780 cases, leading to an average work load of 3-4 cases per technical staff member per month.

The forensic services provided by the DEFS are guided mainly by in-house standards, the standard operating procedures laid out by the Met and the Association of Chief Police Officers (ACPO) Good Practice Guide for Digital Evidence (2011).¹ All laboratories of the DEFS are also actively working towards ISO/IEC 17025 (ISO/IEC 2005) accreditation as required by the UK Forensic Science Regulator in its 2011 ‘Codes of Practice and Conduct for forensic science providers and practitioners in the Criminal Justice System’. A more detailed and systematic description on the ACPO guide and other standards and best practice guides can be found in Chapter 2.

Multimedia related forensic services in DEFS are mainly conducted by its AV laboratory (‘AV Lab’ hereinafter), so in the following we will focus on the AV Lab only. Note that some descriptions on the AV Lab also apply to the other three laboratories, for example the training and performance evaluation practices and the working environment.

1.2.3 AV Lab: Operational and Procedural Aspects

The AV Lab of the Met’s DEFS is one of the best equipped digital forensics laboratories in the world in terms of both the range and specification of its enhancement tools, and the expertise and experience of its staff. The team is made up of forensic audio and forensic video practitioners, forens...

Table of contents

• Cover
• Title page
• Table of Contents
• List of Contributors
• Foreword
• Preface
• Acknowledgements
• About the Website
• Part One: Multimedia Evidence Handling
• Part Two: Digital Evidence Extraction
• Part Three: Multimedia Device and Source Forensics
• Part Four: Multimedia Content Forensics
• Index
• End User License Agreement