COMPUTERIZED DEVICES
Digital evidence appears on computerized or digital devices. A computer consists of hardware (physical electronic components) and software (machine-readable instructions that tell a computer to perform specific operations) that process data. A computer typically includes:
• a case that contains circuit boards, storage media, and interface connections,
• a display device,
• a keyboard, and
• a pointing device, such as a mouse.
Other related, externally connected components (peripherals), such as printers, scanners, or storage media, may be plugged into the system. Computer systems can take many forms, such as tablets, laptops, desktops, and mainframe computers. A computer system and its components can be very valuable evidence in an investigation. Nearly every internal or external component of a computer system can hold some form of data or metadata that could be useful forensically. Some examples of forensically valuable data include (but certainly are not limited to):
• hardware,
• software and applications (“apps”),
• documents, photos and images, inancial information,
• e-mail and attachments,
• databases,
• browsing history,
• social media data and activity,
• contact lists, and
• maintenance, error, or event logs.
Storage devices, a typical place to start looking for digital evidence, vary in the amount of data they can store and the manner in which they store that data. Regardless of the size or type of storage device, it is critical to remember that it may contain vital information; most document files tend to be fairly small but could carry probative evidence. Hard drives are data storage devices that have an external logic board, connections to external sources of information and power, and some form of storage media (magnetic, ceramic, or glass). Hard drives need not be connected to a computer to be possible evidence; like books on a shelf, they still contain information although they are not currently used. Thumb drives or flash drives are small removable data storage devices with USB (universal serial bus) connections; their size makes them easy to transport and, therefore, conceal. They come in a wide variety of shapes and sizes and can be customized for commercial purposes or branding; thumb drives can be incorporated into other objects, like pocket knives, pens, or watches (Figure 1). Memory cards are very small storage devices typically used in digital cameras, but can also be used with tablets, computers, cell phones, video game consoles, and other electronic devices. A type of memory card is the subscriber identification module, or SIM card. SIM cards are integrated circuits that store the international mobile subscriber identity (IMSI) and the identification and the network information required to authenticate with a mobile carrier network. It is typically found in a mobile device, such as a cell phone or tablet, and come in a variety of sizes (Figure 2). For their size, they can carry large amounts of data and are easily concealed (or overlooked!). Increasingly, digital devices are mobile; the sales of cell phones have out stripped the sales of other digital devices and the sale of traditional computers is dropping steadily (Figure 3). Mobile devices are handheld, portable data storage that provide communications, digital photography, navigation systems, entertainment, data storage, and personal information management—increasingly all in the same device, like a smartphone. Smartphones can hold enormous amounts of data and metadata, including software applications (or apps), documents, e-mail, Internet browsing history, contacts, photographs, passwords, and location information that may be of value for investigations or alibis. The type of information and, most importantly, its format will be determined by the type of device and its operating system, such as Android, Apple, Microsoft, or other (Figure 4). Cell phones can be excellent evidence for a number of reasons. First, they are typically single-user devices and tend to have glass touch screens that make it easier to collect DNA. Second, their size relates to their mobility and is likely to be trans ported to, from, and during crimes. Finally, given the intensity of use, either for per sonal or professional purposes, cell phones tend to have more probative information per unit of storage than a typical computer. As consumers shift to more mobile digital devices, the forensic scientist will have a difficult time keeping up with new products, new software, and updated versions and the interconnectivity of all these in an increasingly global networked communications system. It is important to remember that any digital device can potentially function independently, in conjunction with, or be connected to other computer systems. Finding a cell phone or storage device alone does not necessarily mean it is not connected or networked.
FIGURE 1 Thumb or flash drives come in a wide variety of styles and sizes, even customized ones that look like toys or other objects, like keys.
FIGURE 2 SIM cards carry device and user identification and authentication information for mobile communication devices, like cell phones and tablets. Their size depends on the device for which they are intended.
FIGURE 3 Shipments of digital devices by device type.
FIGURE 4 Shipments of digital devices by operating system, in percent.
