Introduction to Digital Forensics

Digital Forensics
DIGITAL FORENSICS Noting that digital devices
The use of digital devices in everyday life continues to increase as people may contain latent, trace,
integrate technology into their lives. It is estimated that as of 2010, there or biological evidence, the
were over 5 billion cellular phone subscribers worldwide. In addition, new investigator should thoroughly
consumer devices continue to be introduced, including tablet computers, document and preserve
wi-fi readers and media players, as well as internet capable automobiles and this potential evidence for
appliances. processing before the digital
evidence imaging has been
This prevalence of electronic devices in society is matched by a growing done. Please see our evidence
presence of evidence gathered from digital devices in criminal cases. collection and latent print
Current research suggests cell phones and their potential evidence may be sections of this catalog for the
found in over 50% of all violent crimes and an even larger percentage in drug right tools.
crimes in some jurisdictions. The proper investigation and preservation of
this evidence and the maintenance of its integrity is vital to making cases
that stand up to judicial challenges.
Like other evidence, there must be a protocol to establish how digital
data is documented, collected, and preserved. Special tools must be
utilized to extract information from the device on which it is stored without
compromising its integrity. In addition, electronic evidence, like other
evidence found at the scene, will usually require review by an expert, so care
must be taken to capture the information and package the device properly
so the digital examiner has the highest probability of gathering all of the VEHICLE SOLUTIONS!
potential evidence present.
Sirchie has developed a specially
It is the job of the first responder to review the crime scene for electronic
designed Mobile Computer/
devices and determine how each device should be processed. SIRCHIE ®
Cyber Crimes Investigation
is proud to offer high quality digital forensics solutions that will aid Vehicle.
investigations from the crime scene to the courtroom, including methods to
extract information from various electronic devices, as well as packaging to
insure the safe transport of the device to the digital examiner.

For more information see the

Vehicle Section of this catalog
or visit our website at
www.sirchie.com

Phone: +1.919.554.2244 Fax: +1.919.554.2266 387

 Digital Forensics Faraday Protection &
Electronic Storage
STRONGHOLD REUSABLE BAG STRONGHOLD ELECTRONIC INTEGRITY EVIDENCE STORAGE
FEATURES: BAGS (REUSABLE)
• Unique design that prevents data cables The StrongHold Bag (Patented*) is the perfect evidence bag for any type of
from acting as signal conduits
wireless device. First responders can use this bag to ensure proper wireless
• Each StrongHold Bag comes with a clear
evidence bag to allow for proper evidence procedures are kept and that the evidence is protected from potential case
handling. killers - after seizure wireless communications.
• The bags come in 2 sizes: 10” x 7” for cell These bags provide the highest level of faraday protection available. The
phones and 13” x 9” for tablets/netbooks/
notebooks. special tri-weave material used in the StrongHold Bag is made of a Nickel,
Copper, and Silver Plated Nylon, plain woven fabric. This fabric is key in
preventing unwanted signals from corrupting or erasing vital evidence.

CATALOG NO. DESCRIPTION PRICE

FBAGR10 10” x 7” Reusable Stronghold Evidence Storage Bags, 1 ea.
FBAGR13 13” x 9” Reusable Stronghold Evidence Storage Bags, 1 ea.

ELECTROSTATIC DISSIPATION (ESD)

BAGS AND FOAM WRAP
Electronic devices such as phones and tablets,
storage media like discs and SD cards, and PC’s
may contain a wealth of information. Protect
the information they contain from exposure
to damaging static electricity and electrostatic
impulses with ESD bags from SIRCHIE ®. The
new 18” x 24” size is large enough for laptop
computers.

CATALOG NO. DESCRIPTION PRICE

ESD0406 Electrostatic Dissipation Bags, 4” x 6” (10.2cm x 15.2cm), 100 each
ESD0608 Electrostatic Dissipation Bags, 6” x 8” (15.2cm x 20.3cm), 100 each
ESD0810 Electrostatic Dissipation Bags, 8” x 10” (20.3cm x 25.4cm), 100 each
Electrostatic bags come in five sizes for various ESD1012 Electrostatic Dissipation Bags, 10” x 12” (25.4cm x 30.5cm), 50 each
types of electronics, from cell phones to hard
drives. For larger devices, such as a desktop ESD1824 Electrostatic Dissipation Bags, 18” x 24” (45.7cm x 61cm), 50 each
computer or server, use ESD Foam Wrap. ESDF24 Electrostatic Dissipation Foam Wrap, 24” wide x 25’ (61cm x 7.6m), 1 roll

388 SIRCHIE ® Products • Vehicles • Training • www.sirchie.com

 Faraday Protection Digital Forensics

BLACK HOLE FARADAY BAGS BLACK HOLE FARADAY BAGS

(WITH WINDOW) (WITH WINDOW) FEATURES:
Black Hole Faraday bags are manufactured • Usage instructions on bags themselves
ensuring they are used correctly
with the ISOTech shielding system and
• Pockets for evidence cards on back with 10
materials with windows to offer clear cards included
previews of evidence while maintaining a • Windows allow for preview of evidence,
high level of shielding. These bags include monitoring of power of device and phone
protective outer layers to keep shielding condition, review for correct adapter
material from being exposed and come in
three sizes.

CATALOG NO. DESCRIPTION PRICE

FBW10 Black Hole Faraday Bag w/Window, Standard, 7.5” x 4.25”
FBW20 Black Hole Faraday Bag w/Window, Large, 11” x 7.8”
FBW30 Black Hole Faraday Bag w/Window, XL, 17.25” x 13.75”
FBW40 Black Hole Faraday Bag Kit, (1 each: Standard, Large, XL)

BLACK HOLE DATA BAG KIT DATA BAG FEATURES:

The Black Hole Data Bag Kit has an integral • External Dimensions: 17” x 11.75” bag &
shielded, electronically filtered USB 2.0 20” Cable
connection that allows for charging, data • Usage Area: 13.75” x 11”
transfer, and analysis of devices without • Connectivity: Filtered USB 2.0, female
internal, male external
compromising shielding. The kit includes
the Data Bag, a separate faraday bag for TRANSPORT BAG FEATURES:
transport, and a device cradle that allows • External Dimensions: 21.5” x 13.75”
use of capacitive touch screen devices • Usage Area: 18.5” x 13”
inside the data bag.
TOUCH SCREEN DEVICE CRADLE
FEATURES:
• External Dimensions: 21.5” x 13.75”
• External Dimensions: 4” x 5”
CATALOG NO. DESCRIPTION PRICE
FDBK Black Hole Data Bag Kit

TABLETOP STRONGHOLD TENT

This lightweight, portable solution uses
the same Stronghold technology and TABLETOP STRONGHOLD TENT
material as the Reusable StrongHold bags FEATURES:
and is perfect for performing forensic • Dimensions: 20” x 14” x 14”
examinations on active wireless devices. • Double Lined
• Mesh Viewing Window on Top
The tent comes with a wireless StrongHold
• Gloveless Sleeves give full dexterity for
bag to keep your digital evidence secure working with small devices
until you’re ready to examine it. Place your • Designed to have a laptop in tent with
investigation laptop and the evidence inside the tent, device being examined
insert your arms securely into the faraday sleeves, • Protective flap allows you to store multiple
remove your evidence from the included bag and devices in tent at a time
connect it to your investigation laptop for secure
examination. TABLETOP STRONGHOLD TENT
INCLUDES:
CATALOG NO. DESCRIPTION PRICE 1- Tent
FTENT20 Tabletop StrongHold Tent 1- StrongHold Bag (Reusable)
1- LED Light
FTENT22 Tabletop StrongHold Tent w/shielded USB 2.0

Phone: +1.919.554.2244 Fax: +1.919.554.2266 389

 Digital Forensics Mobile Device Forensics

DMSK CONTENTS: DIGITAL MOBILE

5- FBAGR10 10” x 7” Reusable StrongHold®
Evidence Storage Bag for handheld devices
SEIZURE KIT
1- FBAGR13 13” x 9” Reusable StrongHold® The Mobile Seizure Kit is a
Evidence Storage Bag for PC comprehensive collection
1- of each First Responder Cards (Pocket size system for wireless devices
cards that provide the steps to maintain that allows for proper evidence
your forensic evidence on handheld de-
vices such as smartphones/pda, cellphone handling with full Faraday
and GPS) protection for any wireless
1- Remote Charger (Battery operated charger transmitting device. Designed
with tips for different devices to allow for ease of use and to protect the integrity of your evidence, this kit is
handheld devices to remain charged until
acquisition) essential for investigators in the field.
10- ESD1012 10 ”x1 2” Electrostatic Dissipa-
tion Bags
CATALOG NO. DESCRIPTION PRICE
10- ESD0406 4” x 6” Electrostatic Dissipation DMSK Digital Mobile Seizure Kit
Bags
10- IEB1200 12” x 1 5½” Integrity Evidence DIGITAL DEVICE REVIEW KIT
Bags
10- IEB9120 9” x 12” Integrity Evidence Bags The Digital Device Review Kit allows you to conduct mobile triage and
1- DMSKC Black Nylon Carry Bag contains everything you need to be able to forensically process over 4,000
mobile devices on scene and extract in a forensically sound manner any data
DS & DDS System Requirements associated with those devices.
• Processor: 1.4Ghz+
• RAM: 1 GB
• Hard Drive Space: 200 MB
• Windows 2000, XP, 2003, Vista, Windows 7
Get more information from
more devices. Depending on
the model, DS or DDS can
acquire the following data:
• SMS History (Text Messages)
• Phonebook (both stored in the memory of
the phone and on the SIM card)
• Call History No. DDRK1 with Tablet PC pictured
• Received Calls
• Dialed Numbers Device Seizure (DS) - acquire and analyze data from over 4,000 mobile
• Missed Calls phones, PDAs and GPS devices including iPhones. It is delivered in a MS
• Call Dates & Durations
Windows format.
• Datebook
• Scheduler Deployable Device Seizure (DDS) is a version of Device Seizure designed for
• Calendar use in the field. It is integrated into a tablet PC and delivered in a touch screen
• To-Do List format. It can also be provided for installation on any Windows laptop, or tablet.
• Filesystem
• System Files Both software packages are advanced forensic acquisition and analysis tools.
• Multimedia Files (Images, Videos, etc.) Don't settle for half the data. Most commercial cell phone forensic software
• Java Files only retrieves logical data files. That's like doing an investigation on half a
• Quicknotes crime scene. If a tool doesn't have advanced analysis features, it's probably
• More...
because they don't get enough data to analyze. Deleted data and user data
• PDA Databases
• E-mail such as text messages and images can often be found in a physical data
dump of a phone. Device Seizure was designed from the ground up as a
DDRK AND DDRK1 CONTENTS:
1- Tablet PC (DDRK1 only)
forensic grade tool that has been upheld in countless court cases.
3- FBAGR10 Reusable StrongHold® Evidence Point 2 Point has been integrated into Device Seizure. The Point 2 Point
Storage Bag for handheld devices feature converts GPS data points to be read directly into Google Earth so
1- DDS Deployable Device Seizure software
application (integrated on tablet PC) investigators can quickly and easily visualize where these GPS locations are.
1- DS-Device Seizure software application DDS and DS Device Manufacturers and Operating Systems Supported:
(integrated on tablet PC) DDRK1 only
1- Mobile Cable Kit with carry bag Alcatel, Android, BlackBerry, Garmin, Apple iOS, Kyocera, LG, Motorola, Nokia, Palm, Web OS, Samsung,
1- One year subscription for both DS and DDS Sanyo, Siemens, Ericsson, Symbian, TomTom, Windows Mobile, ZTE, Memory Cards
software licenses
10- ESD0406 4” x 6” Electrostatic Dissipation CATALOG NO. DESCRIPTION PRICE
Bags
10- IEB9120 9” x 12” Integrity Evidence Bags DDRK1 Digital Device Review Kit with Tablet PC
1- DDRKC Black Nylon Carry Bag DDRK Digital Device Review Kit without Tablet PC

390 SIRCHIE ® Products • Vehicles • Training • www.sirchie.com

 Mobile Device Forensics Digital Forensics

DIGITAL MOBILE DEVICE KIT DSRK100 CONTENTS:

This versatile forensic stick kit contains easy to use tools for the review of 1- iRecovery Stick – designed to extract active
mobile digital devices including iPhones, iPads, iTouch devices, Android and deleted information from iPhone, iPad,
and iTouch devices
devices, and cell phones.
1- Phone Recovery Stick – designed to recover
active and deleted data from hundreds of
smart phones and tablets including Android
devices, Blackberry phones, Symbian
phones, Windows 7 phones, or any phone
with removable storage such as MicroSD
cards
1- Sim Card Seizure – This SIM reader is
designed to recover deleted text messages
(SMS) from and other information that may
be stored on the seized device’s SIM card
1- Micro-USB Data Cable
1- iPhone USB Data Cable
1- iPhone 5 USB Data Cable
1- DSRKC Plastic Carrying Case

CATALOG NO. DESCRIPTION PRICE

DSRK100 Digital Mobile Device Kit
SIM CARD SEIZURE INCLUDES:
SIM CARD SEIZURE 1- SIM Card Seizure software
This SIM reader is designed to recover 1- Forensic SIM Card Reader
deleted text messages (SMS) and other
information that may be stored on
the seized device’s SIM card. SIM
Card Seizure includes software and
a Forensic SIM Card Reader.

CATALOG NO. DESCRIPTION PRICE

SIM100 SIM Card Seizure

ECLIPSE SCREEN CAPTURE KIT ECLIPSE SCREEN CAPTURE KIT

The Eclipse Screen Capture Kit FEATURES:
is designed as an easy to use yet • High quality camera and base
comprehensive system for the capture • Quick capture process
of user information from screens of • Video and image hashing
cell phones, GPS units, tablets, and • Preview and organization of captures
any other portable device that can be • Video and images in one report
• Total control for the user
photographed. The Eclipse kit allows
the user to capture screen shots from
ECLIPSE SCREEN CAPTURE KIT
mobile devices, add notes to them,
INCLUDES:
and organize the images. Eclipse
1- Eclipse Camera and Hardware base
saves images and video within the
1- Eclipse Software
program and is capable of exporting 1- Hard case for Storage and Transport
reports to most web browsers. 1- Glare Shield and Flexible Arm
1- Standard size Black Hole Faraday Bag
CATALOG NO. DESCRIPTION PRICE
ECL1000 Eclipse Screen Capture Kit

Phone: +1.919.554.2244 Fax: +1.919.554.2266 391

 Digital Forensics Computer Forensics

DCRK CONTENTS: DIGITAL COMPUTER REVIEW KIT

1- DP2C-Deployable P2 Commander with The Computer Review Kit contains easy to use tools that allow for on-scene
external hard drive forensic acquisition of data from any computer system. The bootable kit
1- Windows Breaker maintains forensic
1- DCRKC Black Nylon Carry Bag
integrity by read-only
processing of the
computer. The DP2C
P2 Commander is a
bootable thumb drive
that allows you to
quickly look for evidence
on a PC without making
any changes to the
computer. It also allows
you to extract files
you need. Windows
Breaker is a thumb drive
password breaker for
Windows.

CATALOG NO. DESCRIPTION PRICE

DCRK Digital Computer Review Kit
WBS10 Replacement Windows Breaker Stick, 10 uses

DIGITAL FORENSIC COMPUTER ANALYSIS KIT

This versatile forensic stick kit contains easy to use tools for the detection and
recovery of data from computers, laptops, notebooks, and netbooks.
DSRK200 CONTENTS:
1- Data Recovery Stick – Bootable USB that
allows for recovery of deleted documents,
photos, music, and more using a cluster-
by-cluster forensic grade data recovery
algorithm
1- Windows Breaker Stick – Bootable USB that
allows for bypassing of Windows accounts
– Limit of 10 uses per Windows Breaker
Stick
1- Porn Detection Stick – Bootable USB that
searches through all images and videos on
a computer, scans them for pornographic
content, and creates a report of suspected
pornographic images and videos
1- Chat Stick – Bootable USB that detects and
analyzes chat logs from the most popular
online chat programs
1- DSRKC Plastic Carrying Case

CATALOG NO. DESCRIPTION PRICE

DSRK200 Digital Forensic Computer Analysis Kit
WBS10 Replacement Windows Breaker Stick, 10 uses

392 SIRCHIE ® Products • Vehicles • Training • www.sirchie.com