Computer Forensics Vs. Digital Forensics

Digital forensics (sometimes Digital forensic science) is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime.[1][2] The term digital forensics was originally used as a synonym for computer forensics but has expanded to cover all devices capable of storing digital data and is now used to describe the entire field.[1] The discipline evolved in a haphazard manner during the 1990s and it was not until the early 2000s that national policies were created.

You can remotely connect to a suspect computer via a network connection and copy data from it

Every computer installation is different. Although there are many common components and aspects, computer users can compile their system to their own desire. For this reason, it is the forensic examiner’s job to ensure that s/he has sufficient knowledge of a wide variety of hardware, software and operating systems. It is indeed possible to come across any combination of these components, and the examiner should be prepared to handle all of these. Due to the range of possibilities provided by live forensic analysis, forensic examiners only learn the principles of live acquisition and the effect that specific actions may have on the validity of the evidence. It is

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

Digital crime has been on the increase due to the increasing use of computer and internet. This has led the investigators with another method of fighting this crime. This is Computer Forensics, a process of going into computer hard drive and capturing basic information the user believed it has been erased.

Computer forensics is a new area of crime investigation. However, it is an area of knowledge that is growing at a faster rate. Computer and network forensics investigators are professionals who are mainly trained on various investigation activities related to computer crime. They are trained on how to investigate computer crimes

Digital forensics has been responsible for putting away thousands and thousands of criminals. Ranging from simple crime computer crimes to child pornography. To get quality evidence that can be admissible in court there are steps that are needed in preparing a computer investigation. There are also requirements for data recovery, as well as procedures for corporate investigations. “Digital forensics has become prevalent because law enforcement recognizes that modern day life includes a variety of digital devices that can be exploited for criminal activity, not just computer systems. While computer forensics tends to focus on specific methods for extracting evidence from a particular platform, digital forensics must be modeled such that it can encompass all types of digital devices, including future digital technologies” (Reith, Carr, and Gunsch, 2002).

FORENSICS’, its uses, the users of computer forensics, steps involved in this type of forensic

Forensics is a very important aspect of criminal justice. When a crime is committed and there aren’t any witnesses to the crime, forensic evidence may be the only thing that prosecutors have to work with. The use of forensics also helps identify the perpetrators of various cyber-crimes. Forensic specialists can search databases, IP addresses, and recover documents to determine who is responsible for a crime. As a result, this makes forensic labs a necessary investment for an organization.

A common aspect of digital forensics is that it involves the use of various analyzing tools and techniques in the examination of evidence. It requires scrupulously accurate standards that must stand up against cross examination in courts. According to Casey (2011) the outcome to digital forensic should be “to follow the tails that offenders leave during the commission of a crime and to tie perpetrators to the victims and crime scenes”(pg16). Digital forensics involves applying computer investigation skills and analysis techniques to solve crimes and provide evidence to support your case. Digital forensics attempts to extract certain types of data from electronic devices; organize and document this information into an official report form to be presented in a court of law. Digital forensic is a methodology science that using various analyzing techniques in the interest of determining potential legal evidence. A more technically definition of digital forensics is that it is a “specialized science that uses techniques, processes, and procedures to preserve, extract, analyze, and present electronic evidence.”(Dahake & Daware, 2012)

In a world where technology is increasingly becoming the way of life, it was only a matter of time before crime was no longer just in the streets but happening online as well. Criminals now get a new approach to carry out their crimes with the use of computers. Since technology is more like a murder mystery than catching the bad guy in the act, a new discipline of forensics needed to be put into place. This is known as computer forensics. Forensic science is any science used for the purpose of law. In the case of computer forensics it is “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (U.S. Cert, 2008). Meaning if you do something illegal on the Internet it can be found.

Over the years, forensics have played an integral role in solving crimes of all variety. Technological advances have made life easier for society as whole including those in the field of forensics. Digital forensics utilizes the advances in technology such emails, phones, social media, and other ways digital information could be shared in order to help crimes. People have grown so accustomed to phones, tablets, and computers that they often forgot these kinds of technology were not always around to use. The field of forensics has wisely grown with the advances in technology. Crimes have employed forensics to solve crimes for decades, but now with technology more information is available than ever to help assist in crime solving. Technology makes communication a lot easier and allows to talk people from all walks of life. The advances in technology have also allowed business to grow nationwide and worldwide with the ease of emails and phone calls.

To begin this digital forensic investigation interviews with the Information Technology personnel should be conducted to gather details about the computer systems, components, and network. Interviewing staff will aid in determining the impact the incident has caused to the company such as loss of information and/or profits. During evidence collection SME’s business could suffer major financial losses if computers are moved to a crime lab for an extended period. If possible, an on-site investigation would be most efficient for the company. The investigator will need to collect volatile data related to RAM, log files, caches, and network. To collect nonvolatile data clones of the hard drives may be the best option to prevent interruptions to business operations. Since SME is using Windows Server NT an assessment of the contents of the windows registry can reveal an operators actions, including programs accessed, external tools used, and unfamiliar IP address. After collection of data, an analysis in a forensic lab should be conducted. Using timeline analysis the crime can be reconstructed by examining alterations of files. Throughout this entire process it is essential that proper documentation and chain of custody are maintained. Without this documentation digital evidence may be found irrelevant if court proceedings are necessary. When a timeline is established the investigator may begin sorting through data relevant to the incident. The forensic investigation