A cell site is a low power transmitter with an antenna capable of transmitting radio waves to mobile phones. The reason why the antennas have to be positioned so high on tall masts is because radio waves travel in straight lines and can be deflected or interrupted by buildings or terrain. The antenna transmits radio frequencies allowing us to make calls on a network with our mobile phone – which is also fundamentally a radio transmitter. Macrocells provide additional coverage in areas with a higher number of users such as urban and suburban areas. These Macrocells are usually mounted at street level and are more subtle looking than the larger “mast” cell sites.
Many people believe that when a hard drive is formatted the data on the drive is somehow wiped or irretrievable from the disk. This is certainly not the case. The process of formatting a hard drive simply re-organises the computer’s file structure. If you format a disk you are only changing the file structure not erasing the data on it. In order to bring formatted data back, computer forensic experts would look for “flags” in the raw data that would suggest the start and end of a block of data and then piece this data back together to form a single file. This method is known as “data carving” and proves very successful in recovering data from formatted hard drives.
X-act Forensics recently assisted in a case where footage from a van involved in a robbery was taken. The van pulled up outside a warehouse in the dark to commit the robbery but night vision CCTV cameras managed to captured the van’s registration plate. However, the light from the van’s rear lights made the letters on the registration plate unidentifiable. X-act Forensics used a variety of techniques to change the image contrast and further “zoom in” to capture the identity of the vehicle and the suspects.
Imaging is the first step in acquiring digital evidence in any computer forensic investigation. It is highly important that this process is carried out in the first instance, as questions regarding the methodology of a digital investigation can be raised later should the case go to court.
The image itself is an exact copy of the original computer and is created using a combination of hardware and software. The hardware that is involved is known as a “write-blocker”, and the purpose of this device is so that information can only be read and not written to the hard drive when acquired or analysed. Finally, the imaged is verified using an algorithm know as “MD5 Hash” to confirm that the copy is indeed the same as the original.
Imaging is important so that the data is secured and preserved in it’s original format.