Diversified Forensics: Electronic Evidence

A big problem with digital evidence is, that the suspects can hide the evidence on any location on the Hard Drive. That means a judge, a police office or a forensic analyst can impossible predict where exactly the evidence is located on the Hard Drive. That implies, that the forensic analyst have to search through the entire Hard Drive to find the evidence

Based upon my extensive knowledge, training and experience, I have reasonably determined that when trying to locate the particular information pertain to the investigation it is general practice to have the electronic storage devices searched by an individual that is well qualified when dealing with computer technology especially in different types of environments. This is key because we need to make sure that all the electronic data is complete and pertains to the search warrant without going beyond the scope of it. To properly examine the electronic data in question it would be more efficient to perform an image copy on the drive where it could be examined at a later time in a laboratory. This is correct for the following

The second aspect we identified is that of public safety, given the nature of our work as investigators. Digital forensic investigations can have a very drastic impact on public safety from a community wide concern to that of the health and well being of a single person. Often times when a mobile device is explained by a forensic investigator, the investigation is related to a criminal matter where a person is either harmed physically harmed or harmed in the less

The crucial step of the investigation is the transport and storage of evidence recovered from the crime scene. Tightly controlled access during transport and storage will prevent any unauthorized contact and possible tampering or loss of evidence. The evidence that is recovered at the scene must reach a forensic laboratory as quickly as possible, appropriate conditions will prevent deterioration of evidence during transport and storage. Evidence might have to be stored for some years until a case goes to court or if the case is unsolved so labelling and storing evidence must be appropriately done to avoid contamination or disintegration etc.

When our unit arrived at this residency, we knew exactly what kind of evidence we were searching for because the local court gave us a warrant which gave us the permission to investigate all computer belonging possessed, conducted, or governed by the suspect. So, as we conducted our more thorough search, we observed and obtained numerous hard drives, laptops, thumb drives, and related data storage systems, as well as associated hardware which contained thousands of images and videos involving child pornographic content. We proceeded to photograph each one of these pieces of evidence exactly where we found them. We took medium range, as well as close-up pictures of this evidence and added them to our detailed sketch of the crime scene. We were extra cautious and even had another crime scene investigator within our department videotape our walk-through to help record and narrate our time-line, as well. Once all of the evidence was photographed, documented and sketched properly according to procedural standards, our unit then began to correctly mark and package it. It is very important that this step is done during any kind of investigation because if it is not completed, the evidence obtained is virtually useless. The computers we located were connected to a network and turned on, so we photographed what was on the screen first and then unplugged the power cord from the back of the tower. If computers are not unplugged the correct way, then the unit risks losing the files that are stored on it which would greatly impact the case (U.S Department of Homeland Security, N/A). Anyway, once we unplugged it, we placed labels upon all of the other cords before we disconnected all of them, so we knew how to plug them back in later. We placed the equipment in packaging marked as “fragile” and made sure to keep all of it away from any kind of damaging elements including martinets and radio transmitters. We continued to

It is very important that the data is not altered. Once all the data is retrieved and examined from the computer, the next step is to analyze it. This step is crucial because the forensics investigator can find out when the inappropriate files were transferred or install into the computer and if they have been modified. The analysis is done with specialized tools to review all of the data, protected data, windows registry and email. After the analysis process is completed the forensics investigator will then create a report describing all the steps that he did to find the evidence. The report will be given to the main investigator of the

This manual is to assist forensic technicians who may be responsible for preserving electronic crime scene and recognizing, collecting, preserving, and storing digital evidence. When dealing with digital evidence, these principles apply: The process of collecting, securing, and transporting digital evidence should not change the evidence in anyway. Only trained forensic technicians specifically for digital evidence should conduct the analysis. Everything done during the search, seizure, transportation and the storage of the digital evidence should be documented, preserved and ready for review.

However, there are forensic procedures used to collect and process the forensic evidence from electronic devices. The procedures have to follow the fourth and Fifth

Acquisition. Due to digital evidence’s fragile state, investigators should be aware that it is easily altered, damaged, or deleted by improper handling of the evidence. Examination best practices are conducted on a copy of the original evidence. The original evidence should be secured in a way that would protect a preserve the evidence in its original unaltered state.

One service provided by computer forensics includes electronic discovery. This is where documents, email, intellectual property, trade secrets, copyright issues, databases, internet activity, instant messaging, computer security and network intrusion are all examined and determined what information might be valuable to a case or situation. This area is used when a client has knowledge of what information is on the computer, or other device, and needs help in guiding them

Over the last few years law enforcement has shown some major development and growth when it comes to forensic technology. The use of things such as cell phones, computers, gps devices has drastically increased. As a result, these devices regularly contain vital evidence, including user data, call logs, position, text messages, email, imageries and audio and video recordings. When it comes to cyber forensics, law enforcement has a substantial challenge in keeping current with technology changes. New technology is released onto the marked very quickly, both hardware and software. It is imperative that these agents know when these things will hit the market and how to use them. The enormous capacity of information contained on digital devices

The need for an increase in trained personnel in the criminal justice field with a sufficient level of knowledge and skills to investigate, detect, and prosecute high technology crimes is needed with the ever-increasing problem of technology crimes occurring throughout the world. Skilled investigators are needed to not only investigate and prosecute technology crimes, skilled investigators are needed to protect evidence found on computers and other portable devices so that arrests can be made. The most common form of damage or deletion of evidence is attributed to employee errors and omissions. Any organization that uses computers constantly faced with a “variety of potential problems that can lead to the disruption or, worse, destruction of

Recently in the world of digital technology especially in the computer world there is tremendous increase in crime like unauthorized access, money laundering etc. So, investigation of such cases is much more important task for that kind of crime investigation that’s why we need to do digital forensic

In a crime investigation, police officers play a key role as first responders. The action police officers take at the beginning of the crime scene play a vital role in solving the case. Through and carefulness are the two-main thing in an investigation to ensure that potential physical evidence is not tainted or destroyed, or potential witnesses are not overlooked (Reno, 2000). Thorough an investigation a crucial factor influencing the ultimate legal significance of evidence is that investigators follow with an objective, thorough and thoughtful approach (Lewis, 2015). Physical evidence plays a significant role in the criminal justice system. It is considered as the key element in determining the guilt or innocence of an individual who is being accused of committing a crime. The uses of evidence in the court of law is very important, therefore, crime scene investigators must follow a specific protocol when they are collecting evidences. The goal of this process is the recognize and preserve physical evidence that will yield reliable information to aid in the investigation (Lewis, 2015).

The history of Windows dates back to September 1981, with windows 1.0, it has gone through many versions since then and is a constantly evolving product. These newer version are both designed to improve the product’s current features and to bring in new ones that will improve the operating system; the aim of this is to gain and maintain market share for Microsoft and improve the user experience. Since Microsoft’s motivation is to have as many people using its product and not to aid or obstruct the forensic examination of Windows based computers, this essay will look at the effects these changes make to the recovery of forensics evidence