Digital Forensics

As human overpopulation increases, there will be a lack of resources and basic necessities that will become scarcer elevating crime rates. The broad field of forensics has numerous jobs that specialize in a specific duty. It provides and analyzes evidence in laboratories or offices that helps both state and local police departments solve crimes. As technology advances it also aids in the advancement of forensics. Forensic Science Technicians are required to have a variety of distinctive skills to assist in criminal investigations.

The United States Supreme Courts ruled (Daubert versus Merrell Dow Pharmaceuticals, Inc.) that digital forensic tools used during a forensic examination must have validation for the results of the examination to be upheld in court. This means that any tool or technique used during the forensic analysis of evidence must be validated through the process of the scientific method. There are three important issues in regards to computer forensics: admissibility of evidence, standards (certifications), and the analysis (preservation) of evidence. The term “Validation” refers to the confirmation by examination and the provision of objective evidence that the requirements for a specific use are fulfilled whereas the term “Verification” refers to the confirmation of validation with tools, techniques, and procedures (Flandrin).

A cellular phone rings in a Northern Virginia suburban home; it is 3:00 AM. A digital forensic examiner is on the receiving end of the phone call. The local police department is requesting the examiner’s expertise and his state of the art forensic lab. An individual has just been arrested on child pornography charges, as well as, possible drug trafficking. The suspect is believed to be the ringleader in a drug cartel so this has the potential to be a massive investigation. This digital examiner was once a Northern Virginia police officer who was also a digital forensic examiner for the force. He recently established his laboratory and has recently procured the local police department as a client. Although this is his first case with the

As the lead forensic investigator for XYZ, Inc. my goal is to prepare before the investigation starts, this involves knowing the nature of the assignment and activities, prepare the tools and personnel needed to properly investigate the incident. Additionally, understanding the skill-sets required to extract digital evidence will help build the appropriate team, assign roles to staff and supervisor, and ensure the forensic investigators have appropriate background to perform the extractions needed.

Computers have evolved on how we communicate thru technology. People use technology in creative ways that can complicate the forensic analysis process, importantly when attempts are made to conceal digital evidence. The economy consists of millions of users spend hours surfing the web, stay up to date with current events, and take part in many activities.

According to NIST SP 800-61 (2012), the forensic investigator must have the appropriate training, regular testing and verification of skills to access their organizationally-used software and equipment, awareness of laws and legislation, the skill set to handle unexpected situations and ensure that the acquisition equipment is comprehensive and functional prior to conducting an investigation. The forensic investigator must know his or her own limitations and recognized when it’s time to bring in specialize expertise (Nelson et al, 2010)

The need for an increase in trained personnel in the criminal justice field with a sufficient level of knowledge and skills to investigate, detect, and prosecute high technology crimes is needed with the ever-increasing problem of technology crimes occurring throughout the world. Skilled investigators are needed to not only investigate and prosecute technology crimes, skilled investigators are needed to protect evidence found on computers and other portable devices so that arrests can be made. The most common form of damage or deletion of evidence is attributed to employee errors and omissions. Any organization that uses computers constantly faced with a “variety of potential problems that can lead to the disruption or, worse, destruction of

Every form of digital evidence has a different degree of permanence that requires investigators to gather the evidence in a timely manner.

Digital forensics is the process of uncovering and interpreting electronic data for use in a court of law. The main goal of the process is to preserve any evidence in its most original form while performing a structured investigation by collecting, identifying and validating the digital information which will be admissible in a court of law. To collect the document has to follow certain guidelines. United States v. Gourde (2006) and United States v. Zeigler (2007) are both great examples of cases to investigate the case. The primary goal of this document is to demonstrate the importance of digital forensics in solving criminal investigation. In the following paragraph two criminal cases are studied and analyzed.

We live in the information age; the way people communicate and practice business has changed tremendously. Everyday new technologies such as: operating systems, applications and automated software make our lives easier. As computer technologies continue to grow, the necessity of securing private information has not been an easy task for computer networking administrators and information security teams. For digital forensic investigators, staying on top of rapidly evolving technologies had become an everyday challenge. Therefore, there are several factors that play an important role to be successful in digital forensics career. First, you must become familiar with the newly OS platforms. Secondly, continuous testing, evaluation and research could expand the capabilities of a forensic lab. Lastly, forensic investigators should maintain connections with a

The field of computer forensics is similar to forensic science and criminal justice work so; most computer forensic analysts work for law enforcement agencies. The duties of the analyst are to recover data like documents, photos and e-mails from computers that have been deleted, damaged or tampered with. The challenges that are faced by many analyst is the ever changing nature of today’s technology it causes problems for experts when they are collecting data and trying to preserve it for courtroom presentation. The opportunities that this gives you is to meet and work with people from all kinds of business’s and fields. It also gives you time to work independently or as a team.

Forensics is a very important aspect of criminal justice. When a crime is committed and there aren’t any witnesses to the crime, forensic evidence may be the only thing that prosecutors have to work with. The use of forensics also helps identify the perpetrators of various cyber-crimes. Forensic specialists can search databases, IP addresses, and recover documents to determine who is responsible for a crime. As a result, this makes forensic labs a necessary investment for an organization.

Professionals and examiners use forensic analysis tools, web log and session analysis and hash analysis to generate evidence. Conversely, which forensic analysis tool is deployed depends on the type of investigation and what is in question. Many of these tools are

The role of a Computer Forensic Specialist is very important, in the field of Criminal Justice. Their role help aide law enforcements in investigating and retrieving evidence, related to criminal matters at the time. Their duties involves analyzing the subject’s computer using different kinds of tools that are provided to them. Tools like bit stream/bit-by-bit copy, hashing, forensic analysis, indexing process, recovering deleted data that were deleted by the subject, and encrypted files that are design for only certain people to gain access to. These investigative software or tools are very important and will aide in the process of a criminal investigation.

Four sources of data that stand out for forensic investigators in most criminal investigations are files, operating systems, routers and network traffic, and social network activity. Each data source presents a variety of opportunities and challenges for investigators, meaning that the more reliable data collection and analysis activity typically involves examination of a variety of sources. Digital forensics must cover the four basic phases of activity, which include: data collection, which describes the identification and acquisition of relevant data; data examination, which includes the processing of data through the use