Assignment 1: Computer Forensics Overview

During this period the science of digital forensics grew out of ad-hoc tools and techniques developed by these hobbyist practitioners. This is in contrast to other forensics disciplines which developed from work by the scientific community.[1][13] It was not until 1992 that the term "computer forensics" was used in academic literature (although prior to this it had been in informal use); a paper by Collier and Spaul attempted to justify this new discipline to the forensic science world.[14][15] This swift development resulted in a lack of standardization and training. In his 1995 book, "High-Technology Crime: Investigating Cases Involving Computers",

What are some of the considerations that forensic scientists need to take when examining computers for evidence? Why are these important?

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

Digital crime has been on the increase due to the increasing use of computer and internet. This has led the investigators with another method of fighting this crime. This is Computer Forensics, a process of going into computer hard drive and capturing basic information the user believed it has been erased.

Although computer forensics is a relatively young field of crime investigation, it has become a useful area of knowledge. Organizations and companies are finding it necessary to recruit computer and network forensics investigators. These experts can detect and report various computer crimes. The reports of their findings can be used to provide useful evidence in court. This paper discusses various aspects of computer forensics. It is based on a scenario involving a computer, which is suspected to contain evidence on child pornography.

Computers are common tools used by the culprits behind white-collar crimes. In order to find “culprits,” the forensic accountant will need to be able to dig deep into the company’s computer system. However, without the proper equipment, that process can prove to be very difficult. To facilitate the preservation, collection, analysis, and documentation of evidence, forensic accountants can use specialized software and computer hardware.

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

Digital forensics has been responsible for putting away thousands and thousands of criminals. Ranging from simple crime computer crimes to child pornography. To get quality evidence that can be admissible in court there are steps that are needed in preparing a computer investigation. There are also requirements for data recovery, as well as procedures for corporate investigations. “Digital forensics has become prevalent because law enforcement recognizes that modern day life includes a variety of digital devices that can be exploited for criminal activity, not just computer systems. While computer forensics tends to focus on specific methods for extracting evidence from a particular platform, digital forensics must be modeled such that it can encompass all types of digital devices, including future digital technologies” (Reith, Carr, and Gunsch, 2002).

To ensure accuracy programs rely on mathematical cyclic redundancy check (CRC). By using the CRC validation processes compare the original source of data with the acquired data collected. If the data that had been collected has not been altered in any way then the hash values will be exactly the same. If there is even a slight difference the MD5 will be different when it is hashed again. Anyone can be custodian of the duplicate drive because an undetected alteration would be impossible. The MD5 is one-way which means the procedure cannot be reversed to reveal anything about the data collected except that is

In this essay I will be talking about the key guidelines when it comes to investigating computer related crimes, such as what kind of the sections and sub-sections the offence falls under when regarding the ‘law’. I will also analyse the principle that will apply when dealing with the collection data using the digital forensic unit to analyse the data, more so how this is used to make accurate judgment on why the data was in this location and what its purpose or intended use was. Furthermore I will address what kind the authority the ACPO are granted, and further dissect the responsibilities the chief commissioner has. Lastly I will be addressing one the biggest computer related crimes which Cyber Crime and how ACPO created a method for dealing with such crimes, such as dividing the crime into two different categories of Cyber Crime, and how they differ from one another.

Computer forensic examiners find evidence on electronic devices. They collect it for both civil and criminal cases. They must collect this evidence in a scientific manner, regardless of the underlying case. They also must have a full understanding of various technologies, hardware, and software. An examiner helps answer who, what, where, when, why, and how.

In a world where technology is increasingly becoming the way of life, it was only a matter of time before crime was no longer just in the streets but happening online as well. Criminals now get a new approach to carry out their crimes with the use of computers. Since technology is more like a murder mystery than catching the bad guy in the act, a new discipline of forensics needed to be put into place. This is known as computer forensics. Forensic science is any science used for the purpose of law. In the case of computer forensics it is “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (U.S. Cert, 2008). Meaning if you do something illegal on the Internet it can be found.

In simple terms, computer or digital forensic evidence analysis is the scientific collection of data that is either retrieved or held by a computer storage device that can be used against a criminal in a court of law. For the information to be used in court it should be collected before it is presentation; therefore, there are a number of recommendations proposed to make sure that information collected meets the intended integrity.