Digital Forensic Investigation Methodology For Social Media

When faced with problems as a computer forensics investigator you must be very flexible. There are many different types of computer related crimes in today’s society. They may range from child pornography to identity theft to even insider trading on Wall Street. The possibilities for the criminals in our world to use computers and the Internet against us are endless. The computer forensics or cyber forensics fields are growing but are still learning every day because it is such a young field of study. New things emerge every day that computer forensic investigators must adapt to and begin to learn to help combat these criminals. Investigators will use many tools to help them find incriminating evidence. These investigators must learn these tools inside and out to make sure every test they run can be valid. The computer forensics field is growing rapidly and there are a lot of real world threats that we need these investigators to help us solve.

Review the information in the text sheet entitled “Overview of Evidence and Digital Forensic Analysis Techniques,” which describes different types of digital forensic analysis techniques, such as disk forensics and e-mail forensics.

Instead of seeing the overall picture, Martin was under the impression that tracing his actions will be impossible. Admittedly, digital footprint is one of the cyber forensics close kept secret, which allow investigators to analyze data and trace actions performed while using any information systems in the military networks. In other words, even when Martin walked out from his workplace by hand carrying classified documents, cyber forensics can pin-point to the computer used to access specific website including date and time stamp. As a result, evidence collected on the digital media progressively documented and verified as part of groundwork prior to legal proceedings. Due to enhanced and efficient technologies developed nowadays, criminals in the digital world will face the law sooner than what they would expect

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

The aim of this report is to examine Computer Forensics and Anti Forensics in details, investigation and Analysis techniques, and standard set of procedures which Forensics investigators must follow

This means that digital evidence is hard to destroy and that in order to completely remove the evidence from the internet, one must possess a high level of knowledge in the area (Casey, 2011, p.26). This means that criminals who conduct online crimes will always leave online trails and it is up to the digital forensic scientists to retrieve the evidence (Casey, 2011, p.26). This is a strength and it also shows us why digital forensic scientists can play a crucial role as they are the few people that are trained in locating the trail of evidence left behind by the

The world used to be a place filled with questions and answers that could not be found. As the years have gone by, evidence at a crime scene has become progressively more understood and the world is now a place filled with questions that there are answers to. To get where detectives are today, it took years of experiments, building and knowledge of technology that expanded the mind to places that are hard to believe. Technology is the basis of what it takes to find the vastest amount of information that evidence can provide. It can hold, prove and find information that in past years, could not. Due to the advances in technology, specifically through DNA, fingerprinting and lighting systems, crime scene evidence collection has grown tremendously.

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Investigating a cyberstalking case presents a unique set of challenges. Evidence can be found in digital form, so it can be protected from being lost or damaged, or the complete opposite can be true and it can be easily lost, damaged, corrupted, or rendered inadmissible in court due to flawed forensic gathering practices. It is important, with cases involving digital media that the same procedures be followed when it comes to collecting evidence. Chain of custody documentation must still be kept. The right software must be used to directly copy any hardware seized or searched for investigative purposes.

Countries are regularly updating their legal guidelines to explain how digital evidence affects the digital constitution act. As a result, criminals developed their own tools to conceal their crimes creating real-world challenges for forensics investigators. Today, investigators need to learn from many standards of practice: researching from old to new computer systems, expand mechanical knowledge, create new developments and solutions for any investigation.

Next, evidence is collected and analyzed, including tangible evidence such as hard drives and electronic devices, and the digital evidence they contain. Cybercrime investigations for instant messaging rely on instant messaging exchanges, or conversations between people, as digital evidence. The data includes the IM text and the “meta-data” includes other related evidence such as timestamps, length of time the user has been logged on, and more. Then you must seek expert advice if necessary since these crimes can get extremely technical. For crimes relating to

Digital forensics has been responsible for putting away thousands and thousands of criminals. Ranging from simple crime computer crimes to child pornography. To get quality evidence that can be admissible in court there are steps that are needed in preparing a computer investigation. There are also requirements for data recovery, as well as procedures for corporate investigations. “Digital forensics has become prevalent because law enforcement recognizes that modern day life includes a variety of digital devices that can be exploited for criminal activity, not just computer systems. While computer forensics tends to focus on specific methods for extracting evidence from a particular platform, digital forensics must be modeled such that it can encompass all types of digital devices, including future digital technologies” (Reith, Carr, and Gunsch, 2002).

One of the major roles of the social media in modern policing is acting as an analytical tool. Criminal investigations tend to incorporate use of social media in creating leads towards the suspects . This is mainly because most people have the tendency in updating their whereabouts on social media and even it is possible to know the character of someone by accessing their accounts.

In a world where technology is increasingly becoming the way of life, it was only a matter of time before crime was no longer just in the streets but happening online as well. Criminals now get a new approach to carry out their crimes with the use of computers. Since technology is more like a murder mystery than catching the bad guy in the act, a new discipline of forensics needed to be put into place. This is known as computer forensics. Forensic science is any science used for the purpose of law. In the case of computer forensics it is “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (U.S. Cert, 2008). Meaning if you do something illegal on the Internet it can be found.