Computer Forensic Analysis

Imagine that you are investigating a crime of fraud, where the suspect is creating false documents. Where might you look for evidence on the suspect's computer?

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

It is very important that the data is not altered. Once all the data is retrieved and examined from the computer, the next step is to analyze it. This step is crucial because the forensics investigator can find out when the inappropriate files were transferred or install into the computer and if they have been modified. The analysis is done with specialized tools to review all of the data, protected data, windows registry and email. After the analysis process is completed the forensics investigator will then create a report describing all the steps that he did to find the evidence. The report will be given to the main investigator of the

As the lead forensic investigator for XYZ, Inc. my goal is to prepare before the investigation starts, this involves knowing the nature of the assignment and activities, prepare the tools and personnel needed to properly investigate the incident. Additionally, understanding the skill-sets required to extract digital evidence will help build the appropriate team, assign roles to staff and supervisor, and ensure the forensic investigators have appropriate background to perform the extractions needed.

FORENSICS’, its uses, the users of computer forensics, steps involved in this type of forensic

This essay will look at a number of features that have been added to windows, from Windows XP to Windows 8 and the effects these changes have made to the recovery of forensic evidence. I will firstly look at selected features that have been added to windows since XP and briefly explain their purpose. I will then look at the changes these feature have had that have made it less likely for the digital forensic scientist to provide useful evidence, and then those that have made it more possible for the digital forensic scientist to provide useful evidence.

Computers have evolved on how we communicate thru technology. People use technology in creative ways that can complicate the forensic analysis process, importantly when attempts are made to conceal digital evidence. The economy consists of millions of users spend hours surfing the web, stay up to date with current events, and take part in many activities.

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

Evidence plays a vital role throughout criminal investigations. Typically, we think of evidence as things such as fingerprints, DNA, and fibers. However, evidence as evolved as the world of technology has expanded. Digital evidence also now plays just as much of an important role as traditional evidence. When beginning an investigation that involves digital evidence, it is important for the investigator to know what evidence to look for. Identification of evidence, collection including transportation of evidence and examination of evidence are the three main aspects of the process.

Professionals and examiners use forensic analysis tools, web log and session analysis and hash analysis to generate evidence. Conversely, which forensic analysis tool is deployed depends on the type of investigation and what is in question. Many of these tools are

In simple terms, computer or digital forensic evidence analysis is the scientific collection of data that is either retrieved or held by a computer storage device that can be used against a criminal in a court of law. For the information to be used in court it should be collected before it is presentation; therefore, there are a number of recommendations proposed to make sure that information collected meets the intended integrity.

Practitioners make user of what is called a “forensic kit” in order to image or procure the files from the storage devices in possession of the custodian. Reactive responses are also known as “incident response”. As mentioned in a paper by SANS Institute, a good incident response procedure can be broken down into some basic steps [6] – planning and preparation, incident detection, initial response, response strategy formulation, forensic backups, investigation, security measure implementation, network monitoring, recovery and reporting. More details about each step can be found in the paper. To accommodate these requirements, the forensic kit includes various hardware and software that assists in these phases in a collection process. Below are some types of forensic kits that are used in the computer forensic industry

In a world where technology is increasingly becoming the way of life, it was only a matter of time before crime was no longer just in the streets but happening online as well. Criminals now get a new approach to carry out their crimes with the use of computers. Since technology is more like a murder mystery than catching the bad guy in the act, a new discipline of forensics needed to be put into place. This is known as computer forensics. Forensic science is any science used for the purpose of law. In the case of computer forensics it is “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (U.S. Cert, 2008). Meaning if you do something illegal on the Internet it can be found.

In addition to knowing what happened, there is a need to know who is responsible [49]. Every investigator should ask six key questions during an investigation: what, why, how, who, where and when [42, 50]. The what is determined by the data attributes or metadata; why refers to the motivation; how is the procedure followed to initiate the incident or isolate the necessary evidence; who are the people involved; where refers to the location and when refers to time. The following paragraphs give some clarification on some of the questions, however not all will be discussed. Finding the person who performed an alleged action is vital when trying to lay blame for an action on a computer. As soon as the person has been identified, a much faster avenue is opened to finding the rest of the pieces of evidence. An interview can be conducted to ask pressing questions about motive [8]. In a civil claim the claimant and respondent or other legal persona might be important. An aspect to be considered here is that the investigator must never be suspected of fabricating the evidence and the person it can be attributed to as being the