Forensic Investigation Based On An Imaginary Company

The second aspect we identified is that of public safety, given the nature of our work as investigators. Digital forensic investigations can have a very drastic impact on public safety from a community wide concern to that of the health and well being of a single person. Often times when a mobile device is explained by a forensic investigator, the investigation is related to a criminal matter where a person is either harmed physically harmed or harmed in the less

The crucial step of the investigation is the transport and storage of evidence recovered from the crime scene. Tightly controlled access during transport and storage will prevent any unauthorized contact and possible tampering or loss of evidence. The evidence that is recovered at the scene must reach a forensic laboratory as quickly as possible, appropriate conditions will prevent deterioration of evidence during transport and storage. Evidence might have to be stored for some years until a case goes to court or if the case is unsolved so labelling and storing evidence must be appropriately done to avoid contamination or disintegration etc.

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

The crime scene investigator has authority to determine the extent and nature of the services needed at the crime scene next to the power to arrest and carry a weapon “the investigator, in charge shall determine team composition” (Gardner, 2004). This includes what technical procedures are to follow and what specialized equipment is to be used (Gardner, 2004).

The aim of this report is to examine Computer Forensics and Anti Forensics in details, investigation and Analysis techniques, and standard set of procedures which Forensics investigators must follow

Forensic readiness is a decade old concept that many organizations have taken steps to address and implement. It involves taking steps of preparation in anticipation of a particular type of incident. This includes ensuring adequate logging for monitoring, detection, post-mortem investigation, and event reconstruction. Forensic readiness ensures that adequate staff, training, tools, and external support are all in place in advance. Forensic readiness is becoming a crucial part of risk management, and good incident preparedness helps to increase efficiency, reduce the costs of incident response, and help organizations prioritize resources (Nikkel, 2014).

Computers are common tools used by the culprits behind white-collar crimes. In order to find “culprits,” the forensic accountant will need to be able to dig deep into the company’s computer system. However, without the proper equipment, that process can prove to be very difficult. To facilitate the preservation, collection, analysis, and documentation of evidence, forensic accountants can use specialized software and computer hardware.

Before the reporting of the actual work done can start, it is important to include a section with the terms of reference. This explains the technical terms that is not generally known and any acronyms it might appear in the report. This is important for any readers that are not familiar with forensic terminology.Next a short background to the investigation must be given for the benefit other readers who are not familiar with the case the case.After the background is given, a section on the mandate must be included. This needs to explain who requested and authorized the investigation.It is also important define the scope of the investigation clearly, so that it is clear that the investigation did not venture outside of the legally authorized scope.The evidence must be clearly identified, inclusive of serial numbers and any other identification that can be used to confirm that it is the same as the evidence that was acquired. Where used, the hash codes for the evidence items should also be included to show

On his way back to his office, the veteran examiner was thoroughly impressed with his team’s conduct; they ensured all policies and procedures that the Group 4 Firm had put in place were followed step by step. The officer has worked hard for many years to get to this point in his career. In addition to his due diligence and efforts, he had hired the right company to help him start his business. The story above illustrates what can happen when a laboratory is built from the ground up with the Group 4 Firm’s guidance. As with the forensic investigator described, XYZ, Inc. is in the process of opening a new digital forensics laboratory and is hoping, with Group 4 Firm’s support, their personnel and new facility will achieve success. One may ask what it takes to put a digital forensics laboratory together. With its proven track record, the Group 4 Firm knows what it takes to get the job done. The Group 4 Firm will assist XYZ, Inc. by proposing a plan for a 100-person facility that will work efficiently. In ascertaining the scope of XYZ, Inc.’s investigative services, the Group 4 Firm’s proposal is comprised of numerous considerations, including the (1) physical and

The client is known for taking these types of incidents to court for prosecution to the full extent of the law, so it is imperative that the investigation follows all procedures for documentation, digital evidence collection, and digital evidence storage required to ensure admissibility in court. Furthermore, XYZ, Inc. has been given four tasks that must be completed to ensure a clear and concise plan has been developed. This plan would then be implemented for utilization into the

As the lead forensic investigator for XYZ, Inc. my goal is to prepare before the investigation starts, this involves knowing the nature of the assignment and activities, prepare the tools and personnel needed to properly investigate the incident. Additionally, understanding the skill-sets required to extract digital evidence will help build the appropriate team, assign roles to staff and supervisor, and ensure the forensic investigators have appropriate background to perform the extractions needed.

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

According to NIST SP 800-61 (2012), the forensic investigator must have the appropriate training, regular testing and verification of skills to access their organizationally-used software and equipment, awareness of laws and legislation, the skill set to handle unexpected situations and ensure that the acquisition equipment is comprehensive and functional prior to conducting an investigation. The forensic investigator must know his or her own limitations and recognized when it’s time to bring in specialize expertise (Nelson et al, 2010)