Essay on Data Acquisition

Although DRAMs become less reliable when they are not refreshed, they are not immediately erased, and their contents persist sufficiently for malicious (or forensic) acquisition of usable full-system memory images

The use of data in today’s commercials is a vital role that cannot be overlooked. That is there is a need to backup data on physical mediums. The main mediums are hard-drive, flash drive, optical disc, and tape drive. There is multiply different version of each main type of medium. These different physical mediums store data in different ways. Fragmentation can also be an issue for some of these physical mediums. I will cover each medium in a little depth because of the different types available in today’s market.

Security-This is a sub-characteristic of the system’s functionality.It relates to the prevention of unauthorized access to the company’s confidential data by using dashboard software.

This will allow any active footprints to be collected that would otherwise disappear if the information system was restarted (Nelson et al., 2015). After the live data is secured, the team will proceed to create forensic images of the identified desktops before proceeding to do the same with the appropriate servers. Due to the medical information that could potentially be collected during this imaging process, these hard drives will be placed into their appropriate containers before being placed in a travel safe and secured to ensure the devices are protected from easy theft in

What are some of the considerations that forensic scientists need to take when examining computers for evidence? Why are these important?

A big problem with digital evidence is, that the suspects can hide the evidence on any location on the Hard Drive. That means a judge, a police office or a forensic analyst can impossible predict where exactly the evidence is located on the Hard Drive. That implies, that the forensic analyst have to search through the entire Hard Drive to find the evidence

Review the information in the text sheet entitled “Overview of Evidence and Digital Forensic Analysis Techniques,” which describes different types of digital forensic analysis techniques, such as disk forensics and e-mail forensics.

Identifying evidence is the first stage in the process. A laptop, computer monitor, and hard drive are all pieces of evidence that are usually located first. It is critical for the investigator who is identifying and collecting evidence to know what else to look for. Other items that should be identified and collected as possible evidence include external hard drives, floppy discs, CD’s, USB drives, and memory cards. If the investigator isn’t aware what all falls into the category of digital evidence, it is possible that vital evidence may not be collected (Cosic, 2011).

Based upon my extensive knowledge, training and experience, I have reasonably determined that when trying to locate the particular information pertain to the investigation it is general practice to have the electronic storage devices searched by an individual that is well qualified when dealing with computer technology especially in different types of environments. This is key because we need to make sure that all the electronic data is complete and pertains to the search warrant without going beyond the scope of it. To properly examine the electronic data in question it would be more efficient to perform an image copy on the drive where it could be examined at a later time in a laboratory. This is correct for the following

When a mobile phone is submitted for laboratory processing, usually specific items are requested for recovery. These terms may be call logs, graphics, etc. If the forensic examiner has any doubt during the process, he should contact the submitter for clarification. It is recommended to do a complete acquisition to avoid redoing the process later. Sometimes, if there is a limited scope search warrant, it will not be possible to recover all available data. For example first the text messages, then only the items that are covered by the warrant should be reported. The following steps are followed in general for memory card data acquisition:

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

It is pertinent during the preparation phase of an investigation, as well as the examination and documentation phases. Furthermore, these interviews are being conducted to gather information regarding the case to ensure the digital forensic investigator may plan their investigation accordingly. However, if a digital forensic investigator does not take time to prepare for the case, than they may overlook a crucial piece of evidence. Therefore, it is necessary that digital forensic investigators understand the interview process and how victims, suspects, or witnesses would react to questioning (UMUC, 2015). Accordingly, this document provides information regarding the material obtained from an interview, the interview methodology, and the recording methods that may be utilized during an

The reduced data process required only 79 seconds to collect the subset from a 320GM hard drive, which presents a significant reduction in time when compared to the time required to forensically image and verify a hard drive using standard forensic bit-by-bit imaging (2014). The proposed methodology presents an efficient solution for reducing data storage requirements while simultaneously reducing the chances of a privacy violation from reviewing unrelated personal information.

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Some of the most important procedures used in collection of information to be used in a court of law include collecting live data from the RAMs images. Such live recovery of information can be collected from the F-Response which can collect data from the networks of a computer. Information can be collected when the computer is logged on or connected to the network or when the computer is executing (Carrier, 2006, p. 56). The other procedure that can be used in the collection of information for forensic purposes is the encryption of hard disks. Encryption of the hard disk creates logical images that can be collected using the F-Response (Eoghan & Gerasimos, 2008, p. 95). The other important procedure for collection of information is making sure that all data storage devices are kept away from magnets and any other devices that might destroy data stored in them. It is important that the handling individuals obtain the information collection manuals that help them collect information effectively (Eoghan & Gerasimos, 2008, p. 94).