Computer Forensic Essay

When faced with problems as a computer forensics investigator you must be very flexible. There are many different types of computer related crimes in today’s society. They may range from child pornography to identity theft to even insider trading on Wall Street. The possibilities for the criminals in our world to use computers and the Internet against us are endless. The computer forensics or cyber forensics fields are growing but are still learning every day because it is such a young field of study. New things emerge every day that computer forensic investigators must adapt to and begin to learn to help combat these criminals. Investigators will use many tools to help them find incriminating evidence. These investigators must learn these tools inside and out to make sure every test they run can be valid. The computer forensics field is growing rapidly and there are a lot of real world threats that we need these investigators to help us solve.

Forensic Researchers use the JTAG to gain access and recover information stored on the memory chips and generate forensic images of these chips. (Alghafli, Jones, and Martin. 2012).

By performing the tasks required in this lab, many other attributes, references, and system information was gleaned that will benefit forensic efforts in the future. For this lab, the time zone of the computer has been isolated to China Standard Time, which in itself is suspicious. BHOs and add-ins were also located using registry values. Among this, there was only a reference to Bing Bar, which was identified in an earlier lab as a download performed on Jane’s computer. Moreover, this lab uncovered startup applications (UPnP.exe and SCVHhost.exe) that were identified as potentially suspicious in previous labs. Lastly, this lab allowed the student to locate USB storage devices that were connected to Jane’s system as well as the times associated with the connection and removal of the device in the system’s

Live system forensics — the process of searching memory in real time, typically for working with compromised hosts or to identify system abuse is live system forensics. Each of these types of forensic analysis requires specialized skills and training. Determine the nature and criminal or civil implication.

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

“CHFI investigators can draw on an array of methods for discovering data that resides in a computer system, or recovering deleted, encrypted, or damaged file information known as computer data recovery (“Computer Hacking”, n.d.)”. A person who is a certified Computer Hacking Forensic Investigator has the skills necessary to identify an intruder’s footprints and to properly gather the necessary evidence to prosecute in the court of law (“Computer Hacking”, n.d.).

Digital crime has been on the increase due to the increasing use of computer and internet. This has led the investigators with another method of fighting this crime. This is Computer Forensics, a process of going into computer hard drive and capturing basic information the user believed it has been erased.

The reduced data process required only 79 seconds to collect the subset from a 320GM hard drive, which presents a significant reduction in time when compared to the time required to forensically image and verify a hard drive using standard forensic bit-by-bit imaging (2014). The proposed methodology presents an efficient solution for reducing data storage requirements while simultaneously reducing the chances of a privacy violation from reviewing unrelated personal information.

Just as other forms of evidence, digital evidence must be assured not to get wet, stepped on, driven over, and frozen and so on. Magnetic media of all sorts can be fragile and if not handled with care can be wiped out. this is why officers should take special care to handle the evidence and package it accordingly as not doing so would cost them a case. Third issue that can also affect digital data if not done properly is the turning off or powering down a device. Computers store information on the RAM system which can be erased if not closed properly. As well the computer may have applications, documents, images, or any other data may have been left opened by the user can be erased if the computer is turned off. It is best that the investigator not to commit any action when dealing with an computer such as clicking the mouse, clicking on any files, using the keyboard, or apply any software to the suspects computer

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Improvements in technology have demonstrated that with relative ease nefarious individuals can acquire various types of information with the use of computers, cellphones, tablets, databases and the internet. This information can be used for a large array of deeds, illegal activity being a major one. In an effort to combat this emerging type of crime, the Department of Justice, local law enforcement agencies, banks, retail stores, and investment firms are integrating computer forensics into their organizations. These crimes range from network security breaches at companies like Target and Home Depot to child pornography, the common thread is that the implicating evidence was found on an electronic media device.

(2006), volatile data is deemed data that is on a powered on system that will be lost when shutdown. One very important source of data that can be collected from a live system is the information contained in random access memory (RAM) like “data files, password hashes, and recent commands” (Kent et al., 2006). Furthermore, digital forensic investigators can also collect further digital information from RAM like slack space, free space, network configuration, network connections, running processes, open files, login sessions, and operating system time.

The first thing to do when to a computer investigation is to know the correct steps to make sure that the investigation is done correctly. The steps of preparing for a computer investigation are as follows; identifying the nature of the case, identifying the type of OS or digital device, determining whether you can seize the computers or digital devices, getting a detailed description of the location, determining who is in charge, using additional technical expertise, and determining what tools you need. These steps are the foundation of the investigation. If there is no strong foundation in the beginning of the

The three items that I would collect would be the external hard drive, the laptop, and the USB thumb drive. It’s important to remember that you ”must use caution when collecting, packaging, or storing digital devices to avoid altering, damaging, or destroying the digital evidence. Avoid using any tools or materials that may produce or emit static electricity or a magnetic field as these may damage or destroy the evidence” (Mukasey, 2008). The first item that I would collect as digital evidence would be the external hard drive. It may contain all types of evidence such as: files, logs, pictures, recordings, or even video logs. Before collecting it as evidence I would take pictures of the hard drive, making sure to get the manufacturer and serial numbers, and then document it. Once complete, I would seal it in an anti-static bag and label that as well. The second item that I would collect would be the laptop. This could have all of the same type of information that the hard drive has and also may contain copies, pictures, or the source code itself from “Product X.” The laptop may show whether or not he was sharing files or trade secrets with outside sources, or even if he were attempting to crack passwords so as to get into systems that weren’t available to