Digital Forensics : The Use Of Anti-Forensic Methods

Digital forensics has always been known across technologists and law enforcement as the art of hacking into a computer and retrieving important information. Information that holds the key to important crimes and issues surrounding criminal activity. More importantly, digital forensics has the ability to make the non-believer surrounding a criminal case into a swift prosecutor ready to use his or her fullest extent of the law; regarding the sensitive data that comes out of that powerful piece of machinery as we know today as technology. Digital forensic scientists have begun to venture into the world of cloud computing and its familiar components. Components such as remote servers, web browsers, and web based media devices that are connected to the cloud.

Computer forensics are used in many fields, from legalities involving trade secrets to prevention of computer-related fraud; however, more and more computer forensics are being used to help solve crimes of all kinds. Computer forensics have both obvious and less obvious implications in a criminal court and are a helpful new tool for prosecutors and police alike.

Digital crime has been on the increase due to the increasing use of computer and internet. This has led the investigators with another method of fighting this crime. This is Computer Forensics, a process of going into computer hard drive and capturing basic information the user believed it has been erased.

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Since the introduction of computer and technology, they have become the new weapon in committing crime, and to the burgeoning science of digital evidence, law enforcement now use computers to fight crime. Nevertheless, digital evidence is information stored, transmitted, and received in binary form that can potentially be relied on as evidence in court. Notwithstanding, digital evidence is commonly associated with crimes that involve such devices, such as a computer hard drives, external storage devices, mobile phones, among others, and are often referred to as e-crimes. However, to fight e-crime, law enforcement must collect relevant digital evidence for such crimes, law enforcement agencies are incorporating the collection and analysis of digital evidence, also referred to as computer forensics, into many of their infrastructures.

Data hiding is a commonly used AF technique which is defined as “the art of hiding the fact that communication is taking place, by the hiding of information in other information“(Tyagi, 2012, p.120). Data is hiding is used to essentially removing data from view so it is far less likely to be uncovered meaning that it won’t be used in the forensic investigation. The evidence will not be changed or

As technology continues to pervade our lives, and the use in mobile technology becomes more popular, businesses and institutions will began to depend more on mobile computing. Consequently, the likelihood of its use in criminal activity will continue to increase. This means that digital forensics analyst must not only be knowledgeable of traditional desktop operating systems but must also be familiar with the design of mobile operating

This paper will help explain the basic understanding of computer forensics. I will also identify five areas in computers and computer application a forensic investigator can look for digital evidence. I will identify three types of criminal investigations that can utilize the services of computer forensic investigators. This paper will help with the understanding of computer forensics.

Digital forensics is an ever changing field and the number of examinations being performed by digital forensic laboratories is constantly growing. Because investigations often rely on the results of these examinations, particularly those cases built on the digital evidence, investigators need to be able to provide results as soon as it is possible. To meet the growing demand and customer needs, ongoing research and development is needed in the creation of tools that will increase efficiency of digital forensic examinations. To improve efficiency and effectiveness in forensic processes, investigators should concentrate on specific areas including preparation and preservation, extraction and storage, examination and reporting, sharing, correlating

A common aspect of digital forensics is that it involves the use of various analyzing tools and techniques in the examination of evidence. It requires scrupulously accurate standards that must stand up against cross examination in courts. According to Casey (2011) the outcome to digital forensic should be “to follow the tails that offenders leave during the commission of a crime and to tie perpetrators to the victims and crime scenes”(pg16). Digital forensics involves applying computer investigation skills and analysis techniques to solve crimes and provide evidence to support your case. Digital forensics attempts to extract certain types of data from electronic devices; organize and document this information into an official report form to be presented in a court of law. Digital forensic is a methodology science that using various analyzing techniques in the interest of determining potential legal evidence. A more technically definition of digital forensics is that it is a “specialized science that uses techniques, processes, and procedures to preserve, extract, analyze, and present electronic evidence.”(Dahake & Daware, 2012)

The field of digital forensics has become increasingly more important over the last few years as both the computer and the cellular market has grown. The field of digital forensics is relatively new [16, 17]. Various methodologies have been proposed, yet there is no accepted standard procedure within the digital forensics community. Several forensic techniques are used with success where others have failed to prove events beyond doubt. Reasons for this failure include inadequate resources, lack of sufficient training and shortage of funding. Experts are scarce and expensive [18], while the lack of a professional association governing the actions of experts has been criticized [18, 17]. Within the research community there are also inconsistencies in terminology used to describe various processes [19,20].

In a world where technology is increasingly becoming the way of life, it was only a matter of time before crime was no longer just in the streets but happening online as well. Criminals now get a new approach to carry out their crimes with the use of computers. Since technology is more like a murder mystery than catching the bad guy in the act, a new discipline of forensics needed to be put into place. This is known as computer forensics. Forensic science is any science used for the purpose of law. In the case of computer forensics it is “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (U.S. Cert, 2008). Meaning if you do something illegal on the Internet it can be found.

This paper provides an overview of the field of digital evidence and forensics from the perspective of the use of these fields in finance or digital crimes. Specifically, this paper investigates digital evidence and techniques for digital forensics in terms of how they complicate or facilitate the investigative process: how can forensic investigators apply new methods, given the rapidly expanding scope of cybercrime? How can new digital techniques facilitate investigations of computer fraud and other crimes? This paper considers computer and digital evidence from a forensic standpoint, considering how they have changed or rendered obsolete the already novel protocols for investigating such crimes. Conducting an in-depth review of

In 2001, the first Digital Forensic Research Workshop (DFRWS) (http://www.dfrws.org/2001/dfrws-rm-final.pdf ) was held to produce and define a scientific methodology to drive digital forensic to produce a reliable Framework (dubbed Investigative Process for Digital Forensic Science) to drive the

The purpose of anti-forensics is to intentionally make digital investigations and the examination of digital media more difficult through several means including data forgery, data hiding or data deletion. The techniques differ in what they do but the purpose is to make sure data is unrecoverable. (Lucia, 2013)