Essay on Computer Forensics Case Projects Chapter 2

Imagine that you are investigating a case where the suspect is believed to have deleted information from his or her computer that might be evidence. Where would you look for this evidence?

2. Explain, from a forensics perspective, the digital evidence found on the Anthony family computer

Based upon my extensive knowledge, training and experience, I have reasonably determined that when trying to locate the particular information pertain to the investigation it is general practice to have the electronic storage devices searched by an individual that is well qualified when dealing with computer technology especially in different types of environments. This is key because we need to make sure that all the electronic data is complete and pertains to the search warrant without going beyond the scope of it. To properly examine the electronic data in question it would be more efficient to perform an image copy on the drive where it could be examined at a later time in a laboratory. This is correct for the following

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

Investigating a cyberstalking case presents a unique set of challenges. Evidence can be found in digital form, so it can be protected from being lost or damaged, or the complete opposite can be true and it can be easily lost, damaged, corrupted, or rendered inadmissible in court due to flawed forensic gathering practices. It is important, with cases involving digital media that the same procedures be followed when it comes to collecting evidence. Chain of custody documentation must still be kept. The right software must be used to directly copy any hardware seized or searched for investigative purposes.

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

Computers have evolved on how we communicate thru technology. People use technology in creative ways that can complicate the forensic analysis process, importantly when attempts are made to conceal digital evidence. The economy consists of millions of users spend hours surfing the web, stay up to date with current events, and take part in many activities.

The first thing to do when to a computer investigation is to know the correct steps to make sure that the investigation is done correctly. The steps of preparing for a computer investigation are as follows; identifying the nature of the case, identifying the type of OS or digital device, determining whether you can seize the computers or digital devices, getting a detailed description of the location, determining who is in charge, using additional technical expertise, and determining what tools you need. These steps are the foundation of the investigation. If there is no strong foundation in the beginning of the

This manual is to assist forensic technicians who may be responsible for preserving electronic crime scene and recognizing, collecting, preserving, and storing digital evidence. When dealing with digital evidence, these principles apply: The process of collecting, securing, and transporting digital evidence should not change the evidence in anyway. Only trained forensic technicians specifically for digital evidence should conduct the analysis. Everything done during the search, seizure, transportation and the storage of the digital evidence should be documented, preserved and ready for review.

The three items that I would collect would be the external hard drive, the laptop, and the USB thumb drive. It’s important to remember that you ”must use caution when collecting, packaging, or storing digital devices to avoid altering, damaging, or destroying the digital evidence. Avoid using any tools or materials that may produce or emit static electricity or a magnetic field as these may damage or destroy the evidence” (Mukasey, 2008). The first item that I would collect as digital evidence would be the external hard drive. It may contain all types of evidence such as: files, logs, pictures, recordings, or even video logs. Before collecting it as evidence I would take pictures of the hard drive, making sure to get the manufacturer and serial numbers, and then document it. Once complete, I would seal it in an anti-static bag and label that as well. The second item that I would collect would be the laptop. This could have all of the same type of information that the hard drive has and also may contain copies, pictures, or the source code itself from “Product X.” The laptop may show whether or not he was sharing files or trade secrets with outside sources, or even if he were attempting to crack passwords so as to get into systems that weren’t available to

The first step I have to do is to determine if I have enough probable cause. Can I get a judge to sign off on my affidavit and search warrant?Now I have obtained all the required information and the warrant I have decided that I will do the investigation at the office. There is no need to take the computer out of the office. With my chain of command form in my hand I am going to start by taking pictures and gathering my initial information. I am focusing on maintaining my integrity of my e-evidence.

With input and guidance from legal, HR and IT, the CSIRT should immediately start gathering evidence, following generally accepted forensics procedures. This includes documenting everything, starting with the condition of the workspace and status of the computers. The CSIRT should collected and store the information from each of the affected system’s memory, storage drives, network

Patrol officers are often called upon to seize a computer for analysis. It is essential that all patrol officers know how to properly seize a computer.

This analysis is based on an imaginary company, ABC Corporation that designs and manufactures wireless routers and telecommunication equipment. However, the company lacks procedures, processes and policies for external forensic examination. The following discussion details a policy and process that may structure forensic examination requirements for a crime possibly committed using one of the company’s computers.