Digital Forensics Is The Procedure Of Revealing And Understanding Electronic Information

Digital forensics (sometimes Digital forensic science) is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime.[1][2] The term digital forensics was originally used as a synonym for computer forensics but has expanded to cover all devices capable of storing digital data and is now used to describe the entire field.[1] The discipline evolved in a haphazard manner during the 1990s and it was not until the early 2000s that national policies were created.

A big problem with digital evidence is, that the suspects can hide the evidence on any location on the Hard Drive. That means a judge, a police office or a forensic analyst can impossible predict where exactly the evidence is located on the Hard Drive. That implies, that the forensic analyst have to search through the entire Hard Drive to find the evidence

Evidence plays a vital role throughout criminal investigations. Typically, we think of evidence as things such as fingerprints, DNA, and fibers. However, evidence as evolved as the world of technology has expanded. Digital evidence also now plays just as much of an important role as traditional evidence. When beginning an investigation that involves digital evidence, it is important for the investigator to know what evidence to look for. Identification of evidence, collection including transportation of evidence and examination of evidence are the three main aspects of the process.

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

Digital evidence is defined as being evidence that takes form as electronic data, or information stored in bits and bytes on magnetic media. Digital evidence cane range from photos, videos, text documents, internet activity logs, phone numbers, or any other data that is stored electronically that has involvement with a criminal case. Devices that can hold digital evidence are personal computers, computer media, disks, CDs, DVDs, etc. and cellular phones or similar all into one devices and many other types of devices as well. When preserving digital evidence extreme care must be taken. Investigators are sworn in to never change or altar evidence digital or not. Digital data however is very fragile and extra care is imperative. So the first and foremost concern when dealing with digital data is to preserve all data on the hard disk drive or other computer media in a pristine, unaltered, unharmed and unchanged manner.

Supportive investigation procedures and protocols should be in place in order to show that the incriminating evidence was on the electronic media. Crime has changed since the dawning of the computer age and the need for digital forensics is growing rapidly. Digital forensics has various areas based on different standards and media types, each with experts. There have been major breakthroughs in digital forensics

Countries are regularly updating their legal guidelines to explain how digital evidence affects the digital constitution act. As a result, criminals developed their own tools to conceal their crimes creating real-world challenges for forensics investigators. Today, investigators need to learn from many standards of practice: researching from old to new computer systems, expand mechanical knowledge, create new developments and solutions for any investigation.

Digital forensics has been responsible for putting away thousands and thousands of criminals. Ranging from simple crime computer crimes to child pornography. To get quality evidence that can be admissible in court there are steps that are needed in preparing a computer investigation. There are also requirements for data recovery, as well as procedures for corporate investigations. “Digital forensics has become prevalent because law enforcement recognizes that modern day life includes a variety of digital devices that can be exploited for criminal activity, not just computer systems. While computer forensics tends to focus on specific methods for extracting evidence from a particular platform, digital forensics must be modeled such that it can encompass all types of digital devices, including future digital technologies” (Reith, Carr, and Gunsch, 2002).

It is indisputable that the advancement in technology and knowledge has greatly improved the capability to catch criminals. Forensics of the past did not include the tools or knowledge that we now have. Although forensics is not a perfect science nor has it ever been, we are closer to perfecting it than ever. Every criminal leaves behind some traces of evidence; it is up to the professionals to find and analyze it to solve cases. Looking at the timeline of forensics technology of the past to the present it is evident that it has evolved dramatically and will continue to do so.

Forensics is a very important aspect of criminal justice. When a crime is committed and there aren’t any witnesses to the crime, forensic evidence may be the only thing that prosecutors have to work with. The use of forensics also helps identify the perpetrators of various cyber-crimes. Forensic specialists can search databases, IP addresses, and recover documents to determine who is responsible for a crime. As a result, this makes forensic labs a necessary investment for an organization.

The current literature reveals a number of proposed frameworks, models and procedures that have been put in place in an attempt to formally describe an effective digital forensic investigation process. In digital forensic investigations, various processes focus on different actions performed, such as the data extraction, data examination, and data gathering and so on. Others tend to be more concerned with the analysis of the data extracted from the digital media.

In a world where technology is increasingly becoming the way of life, it was only a matter of time before crime was no longer just in the streets but happening online as well. Criminals now get a new approach to carry out their crimes with the use of computers. Since technology is more like a murder mystery than catching the bad guy in the act, a new discipline of forensics needed to be put into place. This is known as computer forensics. Forensic science is any science used for the purpose of law. In the case of computer forensics it is “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (U.S. Cert, 2008). Meaning if you do something illegal on the Internet it can be found.

In this study, a criminal case involving the use of anti-forensics will be introduced that sheds light on the purpose for the need of digital forensics to proactively face the challenges that are presented through the use of these techniques, and establish a basis for the convictions of cyber-criminals, or