Cyber Forensics: From Data to Digital Evidence

CHAPTER THREE

The Power of HEX

Finding Slivers of Data

RONELLE SAWYER IS INVESTIGATING whether Jose McCarthy has potentially engaged in the unlawful distribution of his organization’s intellectual property to a competitor, Ms. Janice Witcome, Managing Director of the XYZ Company.

Ronelle is faced with examining millions of pieces of potential evidential data residing on Jose’s hard drive, looking for the proverbial needle in the haystack, a sequential occurrence of the character string “X,” “Y,” “Z.” Ronelle has deciphered the character’s decimal equivalent into individual binary values, and now must make sense of this run on string of 1s and 0s in an effort to identify a similar string of 1s and 0s on the hard drive seized from Jose’s office.

Our running case is used as a basic illustration of a complex scenario, to communicate to the reader the complexities behind essential building blocks of cyber forensics. It is important for the reader to note that in an actual investigation, searching for a character string of the company name, “XYZ,” as in our example case, may not be ideal as it would generate many false positives. The reader should keep in mind that the examples used in this book are utilized to express forensic concepts or ideas, and not investigative assistance.

The process of deciphering binary values into their decimal equivalents can become very tedious, time-consuming, and very expensive, especially if the string of binary values is large. Fortunately for Ronelle, ...