CSS350 IP5 Essay

At the start of the investigation first responders gave investigator a raw image of the implicated workstation’s memory and hard-drive contents in an EnCase format. These files were copied into evidence files using the Forensic Tool Kit (FTK) application. Appendix A, figure 1 and 2, shows the results of the results of MD5 and SHA1 hashes performed on the two files named ‘jane_ram_ss26’ and ‘jane_hd’. This information validates the

“In 2003, two students from MIT bought 158 used and formatted disk drives from a wide variety of locations. From there they were able to extract over 5,000 credit card numbers, secret corporate financial information, detailed personal and medical information, along with many gigabytes of personal emails and pornography” (Sherweb, 2010, para 2). Computer forensic tools are used to find out and analyzing available, deleted, or hidden information that may be used for evidence in a legal matter. These forensic tools allows the user to uncover potential evidence that someone else does not want to be discovered. This

Stolen laptop computer and hard drive containing sensitive data for up to 26.5 million veterans, their spouses, and active duty military personnel have been found.

This week’s lab builds upon the previous EnCase examination concepts to introduce students to Windows Registry values that can help identify key information within an investigation. To elucidate this, the lab calls for an examination of registry entries within Jane’s (Blacksuit Computing) collected evidence image. Within this image, students are asked to locate key evidence including, the system’s local time zone at acquisition, the location and nature of browser help objects (add-ins), system start-up processes, and a list of first and last devices connected to Jane’s system. Among these, the student is also tasked with analyzing the nature of these items to identify any suspicious activities or entries contained in the evidence.

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

Although computer forensics is a relatively young field of crime investigation, it has become a useful area of knowledge. Organizations and companies are finding it necessary to recruit computer and network forensics investigators. These experts can detect and report various computer crimes. The reports of their findings can be used to provide useful evidence in court. This paper discusses various aspects of computer forensics. It is based on a scenario involving a computer, which is suspected to contain evidence on child pornography.

Computers are common tools used by the culprits behind white-collar crimes. In order to find “culprits,” the forensic accountant will need to be able to dig deep into the company’s computer system. However, without the proper equipment, that process can prove to be very difficult. To facilitate the preservation, collection, analysis, and documentation of evidence, forensic accountants can use specialized software and computer hardware.

Moving onto the weaknesses, the following test will examine the acquisition of information, discovery of information, education, procedure and significance of the evidence. One of the main concerns in this field is still acquiring the information in a way that does not jeopardize the integrity of the information despite having the appropriate tools. This is because digital forensic scientists created the tools for security and other computer related purposes and not for forensic purposes (Casey, 2004, p.29). This poses specific issues when the investigators are trying to collect information in a manner that is acceptable by law, and while it is true that it is possible to create tools specifically for forensic purposes

This is the case of biggest military hack of all the time. Gary McKinnon, a Scottish computer hacker was accused of hacking 97 US military and 16 NASA computer. He hacked the computers over a 13 months period between Feb 2001 to March 2002 using the name 'solo'. He posted a notice on military's website stated -"your security is crap". According to US military, he deleted important files from operating systems and it drastically affects 2000 computers for a day as he deleted all the files, which shut down the US army's military district of Washington networks. Not only this, he even copied all the data, files and passwords onto his own computer. According to US authorities, the cost for tracking and solving this problem was $ 700,000.

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

Digital forensics has been responsible for putting away thousands and thousands of criminals. Ranging from simple crime computer crimes to child pornography. To get quality evidence that can be admissible in court there are steps that are needed in preparing a computer investigation. There are also requirements for data recovery, as well as procedures for corporate investigations. “Digital forensics has become prevalent because law enforcement recognizes that modern day life includes a variety of digital devices that can be exploited for criminal activity, not just computer systems. While computer forensics tends to focus on specific methods for extracting evidence from a particular platform, digital forensics must be modeled such that it can encompass all types of digital devices, including future digital technologies” (Reith, Carr, and Gunsch, 2002).

An extremely important computer forensic service is the preservation of evidence. In this step a forensic image is made of all pertinent data. This image is actually what is being analyzed and the original source where the data was extracted is put in a safe and confidential environment. The security and authenticity of this information is analyzed very carefully and handled only by a digital forensics expert.

A stolen or lost laptop or mobile device can result in a very unfortunate situation depending on what that device contained, especially if the device contains customer information. To make sure this doesn’t happen, protecting the customers’ data when transporting it anyplace on a portable device by encrypting all the data that remains in it. There is always a potentiality threat of an inside employee. However, to help prevent this, an organization should arrange all the crucial functions and responsibilities amongst employees within the organization. This will limit the possibility of an individual committing fraud without the help of other employees. Lastly, organizations should become aware of phishing. Phishing consists of cyber criminals hacking and hijacking corporate social media accounts or creating confusingly similar nicknames, misleading companies or individuals. This could cause employees or consumers to reveal sensitive information because they believe they are communicating with the “official”

To begin this digital forensic investigation interviews with the Information Technology personnel should be conducted to gather details about the computer systems, components, and network. Interviewing staff will aid in determining the impact the incident has caused to the company such as loss of information and/or profits. During evidence collection SME’s business could suffer major financial losses if computers are moved to a crime lab for an extended period. If possible, an on-site investigation would be most efficient for the company. The investigator will need to collect volatile data related to RAM, log files, caches, and network. To collect nonvolatile data clones of the hard drives may be the best option to prevent interruptions to business operations. Since SME is using Windows Server NT an assessment of the contents of the windows registry can reveal an operators actions, including programs accessed, external tools used, and unfamiliar IP address. After collection of data, an analysis in a forensic lab should be conducted. Using timeline analysis the crime can be reconstructed by examining alterations of files. Throughout this entire process it is essential that proper documentation and chain of custody are maintained. Without this documentation digital evidence may be found irrelevant if court proceedings are necessary. When a timeline is established the investigator may begin sorting through data relevant to the incident. The forensic investigation

The first investigation model was appeared in 1984 [2], composed of 4 main phases, which are acquisition, identification, evaluation and admission. Acquisition phase gives the importance of authenticity for investigation process as it will be indicated. Relevant data collection is modeled with identification phase. From all collected data, estimation and hypothesis are examined in evaluation phase. The last phase is admission which involves the presentation of founded results and concluding evidence with understandable form before inspection by the court. However, compared with next adopted investigation framework, this methodology was not focused on securing and preserving data from intrusion during the