97 Things Every Information Security Professional Should Know

Chapter 48. If It’s Remembered for You, Forensics Can Uncover It

Lodrina Cherne

Our phones and computers aim to be more user friendly with every app and operating system upgrade, remembering the person you email the most, the file you recently opened, or the website you always visit. Because this tracking data makes devices more user friendly, it also means that forensic examiners have an increasing amount of data to draw from when investigating digital crime scenes.

If your device recommends doing something you’ve done before, these remembered actions are something that can be uncovered by a digital forensics examiner. By identifying what your devices remember, you’ll be better prepared to work with a forensic professional. Digital forensics and incident response (DFIR) is a field that involves figuring out what happened on a system or network after it happens. Here’s just a few examples of what our computers and mobile devices remember for us that forensics can recover:

• Ever open your word processing app and see it recommend the last 10 files you worked on as things you might want to open again? Forensics can tell you when you opened those files.

• Scroll through your open apps on a mobile device and see previews of those applications as you were last using them? The screenshots are recoverable by forensic analysis.

• Do you like viewing your Downloads folder as a list of files ...