GTU 3170725 Digital forensics (DF) Summer 2026 Solved Paper & Solutions

Imaging means making an exact bit-by-bit copy of a storage device, such as a hard disk or pen drive. The copy is called a forensic image. It includes deleted files and unused space, not only the files a user can see.

Importance:

1. The original stays safe. All analysis is done on the copy, so the original evidence is never changed.
2. Nothing is missed. Deleted and hidden data are also copied.
3. Proof for the court. The hash value (for example SHA-256) of the image matches the hash of the original. This proves the copy is exact.

Digital evidence is any information stored or sent in digital form that can be used in a court. Today almost every crime leaves digital evidence, even a crime that is not done with a computer.

A digital device can play three roles in a crime:

1. Target: the device itself is attacked, as in hacking.
2. Tool: the device is used to commit the crime, as in online fraud.
3. Storage: the device only holds evidence, such as chats, photos, call records and location history.

Example (BTK killer case, USA, 2005): a serial killer named Dennis Rader sent a floppy disk to a TV station, and it was handed to the police. The disk had a deleted Word file. Its metadata (hidden details saved with a file) showed the name "Dennis" and the name of a church. The police traced him through the church and arrested him.

So a murder case was solved with digital evidence.

Meaning

Modus operandi (MO) is a Latin term that means "method of operating". In cyber crime, it is the way a criminal plans and carries out the crime: the tools used, the steps followed and the habits repeated each time.

Why investigators study it

• It links different cases to the same criminal, because a criminal often repeats the same method.
• It reduces the list of suspects.
• It tells the investigator where to look for evidence.

Four types of modus operandi

1. Phishing: sending fake emails or messages to steal passwords and bank details.
2. Malware attack: using harmful software such as a virus or ransomware to damage or lock data.
3. Hacking: entering a computer or network without permission.
4. Identity theft: using the personal details of another person to cheat.

Others are denial of service attacks and cyber stalking.

Phishing in detail

In phishing, the criminal pretends to be a trusted organisation, such as a bank, and tricks the victim into giving secret details.

Steps:

1. Planning: the criminal selects the victims and collects their email addresses or phone numbers.
2. Setup: a fake website is made that looks like the real bank website.
3. Bait: an email is sent, for example "Your account will be blocked. Click here to update KYC."
4. Capture: the victim clicks the link and types the user name, password and OTP on the fake site.
5. Misuse: the criminal uses these details to transfer money from the account.
6. Covering tracks: the fake site is removed and the money is moved through many accounts.

Evidence left behind

• The email header shows the server and IP address that sent the email.
• The link shows the address of the fake website.
• Bank records show where the money went.

1. Active data: the data we use every day. These are the files the operating system can see and open, such as documents, photos and emails. They lie in the allocated space of the disk.

2. Latent data: data that has been deleted or partly overwritten. The operating system no longer tracks it, so a normal user cannot see it. It lies in unallocated space and slack space. Forensic tools are needed to recover it.

3. Archival data: data kept as a backup for later use. It is stored on backup tapes, CDs, DVDs or external hard disks.

A file system is the method an operating system uses to name, store, arrange and find files on a storage device.

Importance:

• It keeps a record of where each file is stored on the disk.
• It keeps track of free space and used space.
• It stores details of each file, such as name, size, dates and owner.
• Without a file system, a disk is only a long row of bits, and no file can be found.

FAT (File Allocation Table) and NTFS (New Technology File System) are two file systems used by Windows.

Cache memory and mapping

Cache memory is a small and very fast memory placed between the CPU and the main memory. It holds copies of the blocks of main memory that the CPU uses most.

Main memory has many blocks, but the cache has only a few lines (places for blocks). Mapping is the rule that decides which cache line a block will go to.

Direct mapping

In direct mapping, each block of main memory can go to only one fixed line of the cache.

Line number = block number mod number of cache lines

Here mod means the remainder after division.

The memory address is divided into three fields:

• Word: selects the word inside the block.
• Line: selects the cache line.
• Tag: tells which block is stored in that line now.

Working

1. The CPU gives an address.
2. The line field selects one cache line.
3. The tag stored in that line is compared with the tag of the address.
4. If they match, it is a cache hit and the word is read from the cache.
5. If they do not match, it is a cache miss. The block is brought from main memory and it replaces the old block in that line.

Example

Main memory has 128 words, so the address has 7 bits. One block has 4 words, so there are 32 blocks. The cache has 8 lines.

• Word field: $\log_2 4 = 2$ bits
• Line field: $\log_2 8 = 3$ bits
• Tag field: $7 - 2 - 3 = 2$ bits

Take the address 54. In binary it is $0110110$.

Check: address 54 lies in block $54 \div 4 = 13$, and $13 \bmod 8 = 5$. So block 13 goes to line 5.

Blocks 5, 13, 21 and 29 all map to line 5. Only one of them can stay in the cache at a time.

Advantages and disadvantage

• Simple and cheap, because only one tag is compared.
• Fast search.
• Disadvantage: if two blocks of the same line are needed again and again, they keep replacing each other, even when other lines are empty.

1. Cyber crime: any unlawful act in which a computer, a network or a digital device is the target of the crime, the tool of the crime, or both. Examples: hacking, online fraud, phishing.

2. Cyber crime scene: the place where the evidence of a cyber crime is found. It includes the computers and phones of the suspect and the victim, storage devices, network devices, servers and online accounts. It can be spread over many places.

3. Cyber crime motivation: the reason that pushes a person to commit a cyber crime, such as money, revenge, curiosity or fame.

Every email has two parts: the body (the message) and the header. The header records who sent the email, who received it, and every mail server it passed through.

Email header forensics is the study of this header to find the real source of an email.

Important fields:

• From, To, Subject, Date: basic details. The From field is easy to fake.
• Received: each mail server adds one such line on top. Reading these lines from bottom to top gives the path of the email. The lowest line shows where the email started.
• Message-ID: a unique identifier given to the email when it is sent.
• Return-Path: the address to which failed emails are sent back.
• Authentication results (SPF, DKIM): show whether the sending server was allowed to send for that domain.

Uses:

1. Finding the IP address of the sender.
2. Detecting a fake (spoofed) email, for example when the SPF check fails or From and Return-Path do not match.
3. Checking the date and time against the suspect's story.

Definitions

• Live system forensics is the collection and study of evidence from a computer that is switched on and running.
• Dead system forensics is the collection and study of evidence from a computer that is switched off. A copy of its storage is studied. It is also called static or post-mortem forensics.

Live system forensics

A running computer holds volatile data. This is data that is lost when the power goes off. It includes:

• contents of RAM,
• running programs (processes),
• open network connections,
• logged-in users,
• passwords and encryption keys held in memory.

The investigator copies this data first, starting with the data that would be lost soonest.

Example: the police find a suspect's laptop switched on, with an encrypted disk already unlocked. If they pull the plug, the key is lost and the disk cannot be read. So they first copy the RAM with a tool such as FTK Imager and copy the open files. The RAM copy is studied later with a tool such as Volatility.

Limit: every action on a running system changes it a little. So each step must be written down.

Dead system forensics

The computer is off. The storage device is connected through a write blocker, a device that allows reading but stops any writing. An exact bit-by-bit image is made, and its hash value is matched with the original. All analysis is done on the image.

Example: a desktop is seized in a fraud case and it is off. The hard disk is removed and imaged in the lab. Deleted account files are recovered from the image with a tool such as Autopsy.

Limit: volatile data is not available.

Comparison

Chain of custody is the written record of every person who handled a piece of evidence, with the date, time, place and reason, from the moment it is collected until it is shown in court.

Importance:

1. Proves the evidence is original. It shows that the item in court is the same item that was collected.
2. Rules out tampering. There is no gap of time in which the evidence could be changed.
3. Fixes responsibility. At every moment one named person answers for the evidence.
4. Makes the evidence acceptable. If the chain is broken, the court can reject the evidence.

When a file is deleted, only its entry in the file system is marked as free. The data stays on the disk until new data is written over it. So it can often be recovered.

Methods:

1. Recycle Bin: a file deleted in the normal way goes to the Recycle Bin and can be restored from there.
2. File system records: the old entry of the file in the FAT directory or the NTFS Master File Table still points to its data. Recovery tools read this entry and bring the file back.
3. File carving: the unallocated space is searched for known file signatures. For example, a JPEG file starts with the bytes FF D8. This works even when no file system record is left.
4. Slack space: the unused end of a cluster can hold parts of an old file.
5. Backups and shadow copies: an older copy of the file is taken from a backup, a restore point or a shadow copy.
6. System files: the page file, the hibernation file and temporary files can hold copies of the data.

Both are features of Windows that save an older state of the computer. For an investigator, they work like a time machine.

Restore points

A restore point is a snapshot of the important system settings at one moment. It is made by the System Restore feature of Windows.

• It saves system files, registry settings, installed programs and drivers. The registry is the database in which Windows keeps its settings.
• It does not save personal files such as documents and photos.
• It is created automatically before a big change, such as installing a program, a driver or a Windows update. A user can also create one by hand.
• Purpose: if the system stops working properly, it can be taken back to an earlier working state.

Forensic value: old copies of the registry show which programs were installed, which USB devices were connected and what the settings were on an earlier date. A program that the suspect has removed can still appear in an old restore point.

Shadow copies

A shadow copy is a snapshot of a whole disk volume at one moment. It is made by the Volume Shadow Copy Service (VSS) of Windows.

• It can copy files even while they are in use.
• It saves only the blocks that have changed since the last snapshot, so it needs less space.
• Windows uses it for the "Previous Versions" feature of files and folders. In Windows Vista and later, restore points are also built on shadow copies.
• It is stored in the hidden folder "System Volume Information".

Forensic value: an older version of a document can be recovered, even when the suspect has changed, deleted or wiped the current file. Comparing versions shows how a file changed over time.

Limits

• Old snapshots are deleted when the space kept for them is full.
• The feature can be switched off, and a user can delete the snapshots.

A web browser saves a record of what the user does on the internet. This includes the websites visited with date and time, searches, downloads, cookies, cache and saved passwords.

Role in an investigation:

1. Shows intention. Searches such as "how to hack a Wi-Fi password" show what the suspect was planning.
2. Builds a timeline. The date and time of each visit show what the suspect did and when.
3. Links accounts. Cookies and saved logins connect the suspect to email and social media accounts.
4. Shows downloads. It tells which files came from which website.

Deleted history can often be recovered.

Motivation is the reason that pushes a person to commit a crime. The main motivations behind cyber crimes are:

1. Money: the most common reason. Examples: online banking fraud, ransomware, theft of card details.
2. Revenge: an angry employee or a former partner wants to harm a company or a person. Example: deleting company data after being removed from a job.
3. Curiosity and thrill: some people, often students, break into systems to test their skill.
4. Fame: to earn a name among other hackers. Example: defacing a well-known website.
5. Political or religious beliefs: attacking the websites of a government or a group to spread a message. This is called hacktivism.
6. Spying: stealing trade secrets of a rival company or secret data of another country.
7. Terrorism: attacking power, banking or transport systems to create fear.
8. Sexual motives: cyber stalking, harassment and sharing of illegal content.

Digital evidence is easy to damage or change. So it must be collected and preserved in a fixed order.

Evidence collection

1. Secure the scene. Move people away from the devices so that nobody can delete or change data.
2. Document the scene. Take photos of the room, the screen, the cables and the position of each device. Write notes with date and time.
3. Identify the evidence. Look for computers, phones, pen drives, memory cards, external disks and routers. Also look for passwords written on paper.
4. Check the power state.

• If a computer is off, do not switch it on.
• If it is on, first collect the volatile data (data lost at power off), such as RAM and network connections.
• Keep a phone in a Faraday bag, which blocks network signals, so that it cannot be wiped from far away.

5. Label and pack. Give each item a tag with a number, date, time and the name of the collector. Pack it in an anti-static bag.
6. Start the chain of custody. From now on, record every person who handles the item.

Evidence preservation

1. Use a write blocker. This device allows reading from the disk but stops any writing to it.
2. Make a forensic image. This is a bit-by-bit copy of the whole disk, including deleted data.
3. Calculate hash values. Find the hash (MD5 or SHA-256) of the original and of the image. Equal values prove that the copy is exact.
4. Work on the copy. All analysis is done on the image, never on the original.
5. Store the original safely. Keep it in a locked room, away from heat, moisture and magnets.
6. Keep the chain of custody updated until the case ends.