Advantages And Disadvantages Of Live Acquisition

The cloud has also given many issues to the field of digital forensics due to the fact that the cloud is part of many applications and software. Software that is hard to grasp physically since most servers that deploy use of the cloud are hidden in very deep corporate areas such as Microsoft, or is scattered across vast space of the internet (CNN Money, Goldman). The cloud has proven itself a valuable tool in the world of digital media but nonetheless has become a tedious and controversial topic in the world of digital forensics. Although there are advances towards the cloud becoming more useful in digital forensics regarding cybernetic crimes and incriminating evidence, the cloud has proven itself very difficult to be analyzed and processed according to the procedure that digital forensic analysts engage upon such as extracting evidence and using it for court

This paper will compare two forensic tools that are available for free on the internet: the SANS Investigative Forensic Toolkit (SIFT) Workstation and The Sleuth Kit (TSK) with Autopsy. This paper is going to look at both forensic tools, compare and contrast, and with the information gathered, will determined which is better over the other. Forensic tools are a must in our profession. Without forensic tools our ability to figure out what happened or what is wrong more difficult. Articles of the use of these forensic tools will be used to see what tool works best and how user friendly the tools are. Both forensic tools are free from the internet, so resources and training for these tools will be compared. With this paper information about what these tools can do, will give readers the ability to figure out which is best for their needs.

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

Digital crime has been on the increase due to the increasing use of computer and internet. This has led the investigators with another method of fighting this crime. This is Computer Forensics, a process of going into computer hard drive and capturing basic information the user believed it has been erased.

Although computer forensics is a relatively young field of crime investigation, it has become a useful area of knowledge. Organizations and companies are finding it necessary to recruit computer and network forensics investigators. These experts can detect and report various computer crimes. The reports of their findings can be used to provide useful evidence in court. This paper discusses various aspects of computer forensics. It is based on a scenario involving a computer, which is suspected to contain evidence on child pornography.

Computers are common tools used by the culprits behind white-collar crimes. In order to find “culprits,” the forensic accountant will need to be able to dig deep into the company’s computer system. However, without the proper equipment, that process can prove to be very difficult. To facilitate the preservation, collection, analysis, and documentation of evidence, forensic accountants can use specialized software and computer hardware.

Moving onto the weaknesses, the following test will examine the acquisition of information, discovery of information, education, procedure and significance of the evidence. One of the main concerns in this field is still acquiring the information in a way that does not jeopardize the integrity of the information despite having the appropriate tools. This is because digital forensic scientists created the tools for security and other computer related purposes and not for forensic purposes (Casey, 2004, p.29). This poses specific issues when the investigators are trying to collect information in a manner that is acceptable by law, and while it is true that it is possible to create tools specifically for forensic purposes

It is very important that the data is not altered. Once all the data is retrieved and examined from the computer, the next step is to analyze it. This step is crucial because the forensics investigator can find out when the inappropriate files were transferred or install into the computer and if they have been modified. The analysis is done with specialized tools to review all of the data, protected data, windows registry and email. After the analysis process is completed the forensics investigator will then create a report describing all the steps that he did to find the evidence. The report will be given to the main investigator of the

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

This manual is to assist forensic technicians who may be responsible for preserving electronic crime scene and recognizing, collecting, preserving, and storing digital evidence. When dealing with digital evidence, these principles apply: The process of collecting, securing, and transporting digital evidence should not change the evidence in anyway. Only trained forensic technicians specifically for digital evidence should conduct the analysis. Everything done during the search, seizure, transportation and the storage of the digital evidence should be documented, preserved and ready for review.

All of these services are important aspects of the computer forensics realm. Each area needs to be carried out in a very specific and careful way so no evidence is ever tampered with or mishandled. Each step of the process is just as important as the first which is why it takes many years of experience to be considered an expert in this field. Each project should be considered as valuable as the next and it's not only important to maintain the services currently offered through computer forensics but to strive to stay on the cutting edge of technology and be able to combat anything that is new to the

(3)http://www.aicpa.org/Research/Standards/Pages/default.aspx Golden, T. W., Skalak, S. L., Clayton, M. M., & Ebooks Corporation. (2006). A guide to forensic

Inept or unqualified individuals are not as knowledgeable with retrieval methods that are accessible using specialized forensics techniques. Dedicated forensics specialists are capable of creating bit-by-bit copy of a drive, without jeopardizing the integrity of data. Competent forensic investigators follow specific forensic methodology that has standard operating procedures for efficiently gather potential evidence (Cumming, n.d.). The goal of an investigation is to understand what happened, who did it, when, how, and why to prevent similar incidents from reoccurring. Dedicated forensic specialists can unearth these answers in a timely and efficient matter. Having dedicated forensics specialists’ means qualified individuals who get it right the first time, because in digital investigation you might not get a second

The aim of this report is to investigate where and how anti-forensic tools work as well as looking at the challenges forensic investigators are faced when such tools are used. After anti-forensic tools are used certain artefacts will be left behind, this report will also cover the procedures and difficulties when trying to uncover these artefacts as well as the tools used to find them.