Cis 4203 Forensics Discussion 1 - Overview of Evidence

When faced with problems as a computer forensics investigator you must be very flexible. There are many different types of computer related crimes in today’s society. They may range from child pornography to identity theft to even insider trading on Wall Street. The possibilities for the criminals in our world to use computers and the Internet against us are endless. The computer forensics or cyber forensics fields are growing but are still learning every day because it is such a young field of study. New things emerge every day that computer forensic investigators must adapt to and begin to learn to help combat these criminals. Investigators will use many tools to help them find incriminating evidence. These investigators must learn these tools inside and out to make sure every test they run can be valid. The computer forensics field is growing rapidly and there are a lot of real world threats that we need these investigators to help us solve.

Evidence plays a vital role throughout criminal investigations. Typically, we think of evidence as things such as fingerprints, DNA, and fibers. However, evidence as evolved as the world of technology has expanded. Digital evidence also now plays just as much of an important role as traditional evidence. When beginning an investigation that involves digital evidence, it is important for the investigator to know what evidence to look for. Identification of evidence, collection including transportation of evidence and examination of evidence are the three main aspects of the process.

What potential sources of digital evidence do you find at a crime scene? First of all, what is digital evidence? Digital evidence is any information or data of value to an investigation that is stored on, received by, or transmitted by an electronic device. Also, Digital evidence or electronic evidence is any probative information stored or transmitted in digital form that a party to a court case may use at trial. Text messages, emails, pictures and videos, and internet searches are some of the most common types of digital evidence. Most criminals now leave a digital trail;

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

The aim of this report is to examine Computer Forensics and Anti Forensics in details, investigation and Analysis techniques, and standard set of procedures which Forensics investigators must follow

In your report, describe how that evidence was discovered and retrieved by law officers or computer forensic experts

The client is known for taking these types of incidents to court for prosecution to the full extent of the law, so it is imperative that the investigation follows all procedures for documentation, digital evidence collection, and digital evidence storage required to ensure admissibility in court. Furthermore, XYZ, Inc. has been given four tasks that must be completed to ensure a clear and concise plan has been developed. This plan would then be implemented for utilization into the

As the lead forensic investigator for XYZ, Inc. my goal is to prepare before the investigation starts, this involves knowing the nature of the assignment and activities, prepare the tools and personnel needed to properly investigate the incident. Additionally, understanding the skill-sets required to extract digital evidence will help build the appropriate team, assign roles to staff and supervisor, and ensure the forensic investigators have appropriate background to perform the extractions needed.

It is indisputable that the advancement in technology and knowledge has greatly improved the capability to catch criminals. Forensics of the past did not include the tools or knowledge that we now have. Although forensics is not a perfect science nor has it ever been, we are closer to perfecting it than ever. Every criminal leaves behind some traces of evidence; it is up to the professionals to find and analyze it to solve cases. Looking at the timeline of forensics technology of the past to the present it is evident that it has evolved dramatically and will continue to do so.

On the other hand, the forensic investigators perform behavioural analysis. This is done by connecting the media to virtual instance(virtual machine) in virtual environment without the internet connectivity. Generally, this technique is very useful in order to identify and investigate about malware besides it will analyse the intention of malware.

In a world where technology is increasingly becoming the way of life, it was only a matter of time before crime was no longer just in the streets but happening online as well. Criminals now get a new approach to carry out their crimes with the use of computers. Since technology is more like a murder mystery than catching the bad guy in the act, a new discipline of forensics needed to be put into place. This is known as computer forensics. Forensic science is any science used for the purpose of law. In the case of computer forensics it is “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (U.S. Cert, 2008). Meaning if you do something illegal on the Internet it can be found.

The different approaches explained different methodology that can be adopted when conducting a forensic investigation for the social media. This section will describe and explain the research

In simple terms, computer or digital forensic evidence analysis is the scientific collection of data that is either retrieved or held by a computer storage device that can be used against a criminal in a court of law. For the information to be used in court it should be collected before it is presentation; therefore, there are a number of recommendations proposed to make sure that information collected meets the intended integrity.