Download CDS Visiting Research Student Programme Device

CDS Visiting Research Student Programme
Establishing the potential forensic artefacts recoverable from a Raspberry Pi
Device
Supervisor: Sarah Morris
- Abstract
The Raspberry Pi is a credit card sized computer which is becoming increasingly popular with the general public. Both
organisations and home users are using the Raspberry Pi in a variety of ways from a standard Linux PC to a part of a
home brewing kit; the small size of the device means that it could be easily hidden or used as a mini computer for a
variety of projects. The variety of uses and low price of the hardware makes it likely that the device will be the
subject of digital forensic analysis in the future.
The Raspberry Pi is generally used with a Linux operating system; several Raspberry Pi customized distributions have
been released. Forensic Investigations of previous Linux distributions have highlighted the importance of contextual
analysis of the artefacts. In order to identify the context of a piece of evidence the analyst must first identify the
structure of the artefact. This is followed by the identification of the system behavior which led to its current state. It
is also necessary to form relationships with other case and system information; relationships provide contextual
corroborate and expand upon the investigators understanding of the events.
This research will start by focusing on the potential forensic artefacts created by general user interaction with the
device; this will be followed by an opportunity to focus on the artefacts created when the device is used in a nonconventional way.
At the end of this research project it is hoped that three contributions to the digital forensic field will be made: a
whitepaper on the forensic artefacts identified for law enforcement investigations, a conference paper based solely
upon this research, and the research will also contribute to a journal paper regarding the impact of the Raspberry Pi
to digital forensics.
- Pre-requisites




An interest in forensic process and digital criminal investigations
A background in Computer Science
Some basic experience of using Linux
Good knowledge of a programming language, preferably at least one of: Python, C/C++, Java or VB.net
- Interview Questions


Critically discuss the potential forensic significance of the introduction of the Raspberry Pi device. [max 1000
words]
The forensic process requires a relationship to be maintained between the original binary data and the
artefacts presented in Court. Briefly explain how an analyst could determine the meaning of a chunk of binary
data found on a storage device. [max 500 words]
Further Information available at: http://cdsvisitingresearchstudentprogramme.wordpress.com/call-forvisiting-research-student-programme-2013/
Or by emailing the supervisor: [email protected]