I provide digital forensics technical consulting, as a party-appointed technical expert and for the drafting of out-of-court technical reports, working with several law firms. My work covers the acquisition of digital evidence, its analysis, and the drafting of a report describing its content and how it was handled.
Areas of work
- Acquisition of digital evidence from mobile devices and computers, with the calculation of the fingerprint (hash) of each acquired item and a written record of the operations performed, so that the integrity of the material can be verified at every later stage.
- Chats and messaging: acquisition and examination of conversations, reconstruction of the timeline, verification of consistency between content, attachments, and metadata.
- Files and documents: integrity verification, metadata analysis, elements useful for dating and attributing documents, photographs, and recordings.
- Email: header analysis, verification of the delivery path and of the sender authentication elements.
- Technical reports, party-appointed and out-of-court, describing the evidence examined, the methodologies adopted, and the conclusions in a form that readers without technical expertise can also understand.
Method
Each acquisition is documented so that it can be repeated and verified by third parties: for each item, the origin, the SHA-256 hash, the times, and the tools used are recorded, along with the version and hash of the executable. Analyses are carried out on copies of the acquired material, without altering the originals.
For acquiring files from mobile devices, I developed Quickshare, an open source tool released under the GPLv3 license: it transfers files from the phone to the computer over a dedicated hotspot, without installing anything on the device. The SHA-256 hash of each file is calculated on both the phone and the computer and compared, and the operations are recorded in a sealed log to be attached to the written record.