# Acquisition

## **Introduction to Forensic Acquisition**

Forensic acquisition is a foundational process in digital forensics, aimed at preserving and analyzing digital evidence. It involves creating an exact, bit-for-bit copy of storage media to ensure that all data, including active files, deleted data, and hidden information, is retained for analysis without altering the original evidence.

***

## **Key Principles of Forensic Acquisition**

### **1. Integrity Preservation**

* **Objective**: Ensure the forensic copy is an exact replica of the original.
* **Method**: Use **hashing algorithms** (e.g., **MD5**, **SHA-1**) to verify the integrity of the data.
* **Outcome**: The hash of the original device should match the hash of the forensic image.

### **2. Non-Destructive Process**

* **Objective**: Protect the original data from alteration.
* **Method**: Investigators work exclusively on the **forensic copy**, leaving the original untouched.

### **3. Admissibility**

* **Objective**: Ensure the evidence is admissible in court.
* **Method**: Follow established forensic protocols to demonstrate the authenticity and integrity of the data.

***

## **Tools for Forensic Acquisition**

* **FTK Imager**:
  * Creates disk images and extracts specific files.
  * Provides an intuitive interface for imaging and previewing evidence.
* **Autopsy**:
  * Open-source platform for analyzing disk images.
  * Supports artifact extraction and timeline analysis.
* **Axiom**:
  * Comprehensive forensics tool with advanced acquisition and analysis features.
  * Focuses on structured reporting and artifact visualization.

***

## **Browser Data Storage Locations**

Web browsers store critical user activity data in structured formats like **SQLite databases** and **JSON files**, which are valuable for forensic investigations.

**Storage Paths for Common Browsers**

*   **Firefox**:

    ```plaintext
    %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\
    ```
*   **Google Chrome**:

    ```plaintext
    %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\
    ```
*   **Microsoft Edge**:

    ```plaintext
    %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\
    ```
*   **Opera**:

    ```plaintext
    %USERPROFILE%\AppData\Roaming\Opera Software\Opera Stable
    ```

***

## **Chrome Browser Artifacts**

Most **Chrome artifacts** are stored under the **Default** folder. Key files include:

### **1. History (SQLite Database)**

* Tracks:
  * URLs visited.
  * Download history.
  * Timestamps.

### **2. Cookies (SQLite Database)**

* Stores:
  * **Session data**.
  * **Tracking information** for user activity across websites.

### **3. Cache**

* Temporary storage for web content such as:
  * **Images**.
  * **Scripts**.

### **4. Bookmarks (JSON File)**

* Provides insights into user preferences and frequently visited sites.

### **5. Login Data (SQLite Database)**

* Stores saved usernames and passwords.
* Passwords are typically **encrypted**.

***

## **Analysis Techniques**

**Manual Analysis**

* **SQLite Browser**:
  * Used to view and query browser databases (e.g., History, Cookies).
* **Text/JSON Viewer**:
  * Allows manual inspection of plaintext or JSON-based files.

**Automated Analysis**

* **BrowsingHistoryView**:
  * Aggregates and displays browser history from multiple browsers in a consolidated view.
* **Hindsight**:
  * Specializes in automated parsing and reporting of **Chrome browser artifacts**.

***

## Key Points

Forensic acquisition is essential to ensure reliable evidence collection. Browser artifacts, such as **history**, **cookies**, and **login data**, provide a wealth of information about user activities. By using both **manual** and **automated tools**, investigators can effectively analyze browser data to uncover critical evidence. In subsequent lessons, you’ll gain hands-on experience with these tools to conduct detailed investigations.
