Digital Forensics

Computer forensics are used in many fields, from legalities involving trade secrets to prevention of computer-related fraud; however, more and more computer forensics are being used to help solve crimes of all kinds. Computer forensics have both obvious and less obvious implications in a criminal court and are a helpful new tool for prosecutors and police alike.

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

Digital crime has been on the increase due to the increasing use of computer and internet. This has led the investigators with another method of fighting this crime. This is Computer Forensics, a process of going into computer hard drive and capturing basic information the user believed it has been erased.

Data is crucial to the success of any company and they are now increasing their efforts in soliciting and retrieving customer data to learn more about their client's preferences, likes, and dislikes. This, among other factors has attributed to a growing field of data science where data scientists learn to collect crucial data. While there are many types of data, this paper will primarily focus on digital data and how digital scientists can retrieve these data to support provide information for the crown or for the defense. This area has received more attention because criminals such as terrorists have realized the effectiveness of using digital devices to aid in their criminal endeavors (Reith, Carr & Gunsch, 2002, p.2). To combat this, law enforcement agencies are now relying on digital scientists to preserve, collect, analysis and interpret "digital evidence derived from digital sources" (Vincze, 2016, p.184) to help prevent cybercrime and prosecute (or exonerate) suspects. The purpose of this paper is then to illustrate why digital forensic is crucial to addressing the new dangers presented in our society by analyzing the strengths and demonstrating why the weaknesses of the field

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Moving onto the weaknesses, the following test will examine the acquisition of information, discovery of information, education, procedure and significance of the evidence. One of the main concerns in this field is still acquiring the information in a way that does not jeopardize the integrity of the information despite having the appropriate tools. This is because digital forensic scientists created the tools for security and other computer related purposes and not for forensic purposes (Casey, 2004, p.29). This poses specific issues when the investigators are trying to collect information in a manner that is acceptable by law, and while it is true that it is possible to create tools specifically for forensic purposes

Supportive investigation procedures and protocols should be in place in order to show that the incriminating evidence was on the electronic media. Crime has changed since the dawning of the computer age and the need for digital forensics is growing rapidly. Digital forensics has various areas based on different standards and media types, each with experts. There have been major breakthroughs in digital forensics

Investigating a cyberstalking case presents a unique set of challenges. Evidence can be found in digital form, so it can be protected from being lost or damaged, or the complete opposite can be true and it can be easily lost, damaged, corrupted, or rendered inadmissible in court due to flawed forensic gathering practices. It is important, with cases involving digital media that the same procedures be followed when it comes to collecting evidence. Chain of custody documentation must still be kept. The right software must be used to directly copy any hardware seized or searched for investigative purposes.

Digital forensics has been responsible for putting away thousands and thousands of criminals. Ranging from simple crime computer crimes to child pornography. To get quality evidence that can be admissible in court there are steps that are needed in preparing a computer investigation. There are also requirements for data recovery, as well as procedures for corporate investigations. “Digital forensics has become prevalent because law enforcement recognizes that modern day life includes a variety of digital devices that can be exploited for criminal activity, not just computer systems. While computer forensics tends to focus on specific methods for extracting evidence from a particular platform, digital forensics must be modeled such that it can encompass all types of digital devices, including future digital technologies” (Reith, Carr, and Gunsch, 2002).

Since the introduction of computer and technology, they have become the new weapon in committing crime, and to the burgeoning science of digital evidence, law enforcement now use computers to fight crime. Nevertheless, digital evidence is information stored, transmitted, and received in binary form that can potentially be relied on as evidence in court. Notwithstanding, digital evidence is commonly associated with crimes that involve such devices, such as a computer hard drives, external storage devices, mobile phones, among others, and are often referred to as e-crimes. However, to fight e-crime, law enforcement must collect relevant digital evidence for such crimes, law enforcement agencies are incorporating the collection and analysis of digital evidence, also referred to as computer forensics, into many of their infrastructures.

An extremely important computer forensic service is the preservation of evidence. In this step a forensic image is made of all pertinent data. This image is actually what is being analyzed and the original source where the data was extracted is put in a safe and confidential environment. The security and authenticity of this information is analyzed very carefully and handled only by a digital forensics expert.

Computer forensics is the process that applies computer science and technology to collect and analyze evidence which is crucial and admissible to cyber investigations (Sindhu & Meshram, 2012). Adding the ability to practice sound computer forensics will help ensure the overall integrity and survivability of an organization’s network infrastructure (U.S. Cert, 2008). In this paper, we review a number of scenarios where computer forensics is necessary. We determine good sources of data for each scenario, and determine which would be optimal.

Every form of digital evidence has a different degree of permanence that requires investigators to gather the evidence in a timely manner.

There may be supplementary requirements regarding documentation of systems and processes to fulfill forensic and evidentiary requirements. The report generation capability provided by the information system should have the capability to generate customizable reports. Furthermore, such analysis can also facilitate the development and implementation of comprehensive solutions, ensuring the use of more effective protective strategies. The results of forensic analysis can also be used to prosecute threat