Cryptography for the Forensics Investigator

There are many challenges for a forensic investigator when it comes to digital evidence. These include the constantly changing technology that may store evidence, the vast amounts of data that is stored, and the increasing use of cryptography. This last problem can prevent any useful information being retrieved and is encountered in the use of communication protocols, whole-disk encryption, and individual applications. Cryptography is a field of great depth and breadth, encompassing both complex mathematics and cutting-edge technology. A forensics investigator does not need to be aware of all aspects of this field, but there are certain areas that are vital. The knowledge described in this chapter can assist an investigator in obtaining information that may otherwise be obscured, and also prepare them to defend the integrity of any evidence obtained.