Computer Forensics Report

Instructions: There are multiple parts to this assignment. Carefully read each section and type your answer in the space provided. Complete each part of this Homework Assignment to receive full credit.

Imagine that you are investigating a case where the suspect is believed to have deleted information from his or her computer that might be evidence. Where would you look for this evidence?

The hard drive on the desk would be a good third source of digital evidence to seize. Assuming this hard drive is used for additional storage (i.e. does not have an Operating System on it), it would contain data similar to that which would’ve been on the USB Flash Drive: documents, images, videos, and maybe even some software files. Documentation should be done on the make, model, serial number and type (e.g. SATA, IDE, SCSI) of hard drive. For transportation, again, place into a static shock protective bag. Remember to keep the hard drive away from anything magnetic as the platters that are inside the hard drive are magnetically charged (U.S. Department of Justice, 2008).

A big problem with digital evidence is, that the suspects can hide the evidence on any location on the Hard Drive. That means a judge, a police office or a forensic analyst can impossible predict where exactly the evidence is located on the Hard Drive. That implies, that the forensic analyst have to search through the entire Hard Drive to find the evidence

Review the information in the text sheet entitled “Overview of Evidence and Digital Forensic Analysis Techniques,” which describes different types of digital forensic analysis techniques, such as disk forensics and e-mail forensics.

Ibrahim Baggili, an assistant Professor of Computer Science at the University of New Haven said this, "Forensic evidence from a smartphone or a computer might be critical to solving a crime (Baggili).” Personal and private information are stored on phones and computers and it is a great tool for a scientist to use when working on a crime.

Evidence plays a vital role throughout criminal investigations. Typically, we think of evidence as things such as fingerprints, DNA, and fibers. However, evidence as evolved as the world of technology has expanded. Digital evidence also now plays just as much of an important role as traditional evidence. When beginning an investigation that involves digital evidence, it is important for the investigator to know what evidence to look for. Identification of evidence, collection including transportation of evidence and examination of evidence are the three main aspects of the process.

When was the last time she accessed her computer? What is her background in computers, what is her skill level? I need some background on the former employee, her computer habits and activities prior to the files being found on her computer. I must collect digital evidence while keeping the data unaltered, first thing. This data will be used later in the prosecution of the case. This can be done through calculating and recording an evidence file. Next is imaging of the computer media with a write-blocking tool. I must keep the chain of custody. The computer's RAM is examined for evidence. During the examination step, verify and catalog the presence and integrity of the original evidence and any copies. An analysis is made with specialized equipment to find out exactly what's stored on the digital media. This includes a manual review of all materials found on the media, a review of the Windows registry, techniques to crack passwords and retrieve protected data, keyword searches and extraction of email and pictures for further review.

The three items that I would collect would be the external hard drive, the laptop, and the USB thumb drive. It’s important to remember that you ”must use caution when collecting, packaging, or storing digital devices to avoid altering, damaging, or destroying the digital evidence. Avoid using any tools or materials that may produce or emit static electricity or a magnetic field as these may damage or destroy the evidence” (Mukasey, 2008). The first item that I would collect as digital evidence would be the external hard drive. It may contain all types of evidence such as: files, logs, pictures, recordings, or even video logs. Before collecting it as evidence I would take pictures of the hard drive, making sure to get the manufacturer and serial numbers, and then document it. Once complete, I would seal it in an anti-static bag and label that as well. The second item that I would collect would be the laptop. This could have all of the same type of information that the hard drive has and also may contain copies, pictures, or the source code itself from “Product X.” The laptop may show whether or not he was sharing files or trade secrets with outside sources, or even if he were attempting to crack passwords so as to get into systems that weren’t available to

Computer forensic examiners find evidence on electronic devices. They collect it for both civil and criminal cases. They must collect this evidence in a scientific manner, regardless of the underlying case. They also must have a full understanding of various technologies, hardware, and software. An examiner helps answer who, what, where, when, why, and how.

In this era of economic recession, the one area that is not affected is the identity theft which is supposed to be a criminal venture of gigantic proportion, earning millions for the offenders and causing a lot of grief and suffering for the victims. To tackle this menace, computer forensics specialists are approached to provide the necessary proof that will incriminate the offenders as well as identify the fraud that has occurred. The computer hackers leave a trail behind them just like us, while using the internet. The hackers make use of our IP addresses to track us and similarly they too can be identified by the information left on the system used by the thieves. This is made possible by the experts in computer forensics. The specialists in computer forensics are capable of creating data available in the form of unallocated bunches into a clear and precise order. The data though erased by the criminals can be retrieved from the system. The system is equipped to store even the deleted information about the details that were stored initially. The increase in the incidence of these identity thefts started with the advent of selling computers online in sites like EBay and also various other auction websites. This does not hold the websites conducting the auction responsible but implicates the persons who put their system gears for sale online. Installing a new operating system over the previous older system does not guarantee its complete removal and you need the

Computer forensics is the practice of accessing sensitive data from technology to utilize within private and criminal investigations. Experienced computer forensics workers work with police to verify and validate evidence for court cases. This part of the investigation must always be done with care and in a precise and professional manner as the evidence must be admissible and useful in the court of law. In this scenario I would follow the below procedures for the investigation and compilation of information.

A Coordination Plan is critical to the success of a large computer forensics laboratory. It is necessary for not only members of the forensics team, but for synchronizing with organizational leads and legal entities. Most labs are operated under best practices and are structured within a hierarchy from the investigation assistant, the lab assistant, the lead investigator as well as the project lead. These positions can be changed based on the case and expertise required. Best practices state that personnel assignments should be made prior to starting the investigation. The coordination plan should be discussed at all levels of an organization since the lab needs to comply with the overall rules and regulations of the organization, but it is also likely that the lab’s functions will impact the organization at some point.

The International Society of Forensic Computer Examiner (ISFCE) it is a private organization declared to providing an internationally recognized that is available to all who qualify, at a cost. According to the ISFCE, the organization seeks to professionalize and further the field of digital forensics, provide a fair and uncompromised process for certifying forensic computer examiners, set a high ethical forensic standard and to conduct research, development, methods into new and emerging technologies for the use in digital forensics. In order to join the ISFCE, an individual must pass the Certified Computer Examiner(CCE). Consequently, The applicant must meet certain criteria before they can sit for the membership. Thus, an applicant

In simple terms, computer or digital forensic evidence analysis is the scientific collection of data that is either retrieved or held by a computer storage device that can be used against a criminal in a court of law. For the information to be used in court it should be collected before it is presentation; therefore, there are a number of recommendations proposed to make sure that information collected meets the intended integrity.