Computer forensic analysis protocols review focused on digital evidence recovery in hard disks devices

Abstract

Fourth Industrial Revolution includes cybersecurity as a key technology, given the increase in the number of devices connected to the Internet, the volume of relevant information available and the incidence of cybercrime on them. Among the lines of study of cybersecurity appears the computer forensic analysis, which seeks to reveal and analyze information in systems based on an analysis of digital evidence. This process involves a series of phases that ensure the integrity of the sources of information from beginning to end. Occupational studies in the area show a deficit of qualified and qualified personnel to cover the demand of processes related to this topic. In order to close this gap, the National Learning Service at Services and Business Management Center implements the Digital Forensic Laboratory. In this paper, workflows of computer forensic analysis procedures described in scientific documents are analyzed and a proposal of a protocol applicable to the laboratory is presented, which allows to rescue digital evidences of hard disks. A six-step procedure is proposed, ranging from the diagnosis of the case, to the presentation of results, through the collection of evidence, the copies of files, the analysis of data and the extraction of information.