Forensic Investigation Research Paper

At the start of the investigation first responders gave investigator a raw image of the implicated workstation’s memory and hard-drive contents in an EnCase format. These files were copied into evidence files using the Forensic Tool Kit (FTK) application. Appendix A, figure 1 and 2, shows the results of the results of MD5 and SHA1 hashes performed on the two files named ‘jane_ram_ss26’ and ‘jane_hd’. This information validates the

Imagine that you are investigating a case where the suspect is believed to have deleted information from his or her computer that might be evidence. Where would you look for this evidence?

This week’s lab builds upon the previous EnCase examination concepts to introduce students to Windows Registry values that can help identify key information within an investigation. To elucidate this, the lab calls for an examination of registry entries within Jane’s (Blacksuit Computing) collected evidence image. Within this image, students are asked to locate key evidence including, the system’s local time zone at acquisition, the location and nature of browser help objects (add-ins), system start-up processes, and a list of first and last devices connected to Jane’s system. Among these, the student is also tasked with analyzing the nature of these items to identify any suspicious activities or entries contained in the evidence.

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

A computer forensic investigation typically includes the collection, examination, analysis, and reporting of data. These steps could have been used to extract and preserve the data in the U.S. versus AOL case. Collection involves seizing digital evidence. Examination is where techniques are applied in order to identify and extract data. Analysis is using the data and resources to prove a case (Brecht, 2015). Reporting involves presenting the documentation gathered during the investigation. Investigators use these steps to examine evidence that could be needed in a trial. Following these steps is one way to ensure that the findings are sound and admissible in court. “The purpose of a computer forensic examination is to recover data from computers seized as evidence in criminal investigations (Brecht, 2015)”. Forensic tools are used by investigators to provide their collection, indexing and detailed analysis

When was the last time she accessed her computer? What is her background in computers, what is her skill level? I need some background on the former employee, her computer habits and activities prior to the files being found on her computer. I must collect digital evidence while keeping the data unaltered, first thing. This data will be used later in the prosecution of the case. This can be done through calculating and recording an evidence file. Next is imaging of the computer media with a write-blocking tool. I must keep the chain of custody. The computer's RAM is examined for evidence. During the examination step, verify and catalog the presence and integrity of the original evidence and any copies. An analysis is made with specialized equipment to find out exactly what's stored on the digital media. This includes a manual review of all materials found on the media, a review of the Windows registry, techniques to crack passwords and retrieve protected data, keyword searches and extraction of email and pictures for further review.

There is a standard set of procedures which Forensic investigators must follow after the computer in question has been physically secluded and these are:

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Principal Brady and Allen Jones, it district’s IT employee, would be notified about the computer being shut down and turned back on. If Mr. Wilkens’ asked why the computer was not as he left it, then Principal Brady and Mr. Jones could tell him an update probably occurred which required a computer reboot. Also, a request would be made for Mr. Jones to allow the investigator to capture any emails or files which Mr. Wilkens would have access to on the server onto a clean hard drive. Mr. Jones may be asked to assist with any database or other data capture which is beyond the knowledge level of the

Before the reporting of the actual work done can start, it is important to include a section with the terms of reference. This explains the technical terms that is not generally known and any acronyms it might appear in the report. This is important for any readers that are not familiar with forensic terminology.Next a short background to the investigation must be given for the benefit other readers who are not familiar with the case the case.After the background is given, a section on the mandate must be included. This needs to explain who requested and authorized the investigation.It is also important define the scope of the investigation clearly, so that it is clear that the investigation did not venture outside of the legally authorized scope.The evidence must be clearly identified, inclusive of serial numbers and any other identification that can be used to confirm that it is the same as the evidence that was acquired. Where used, the hash codes for the evidence items should also be included to show

As the lead forensic investigator for XYZ, Inc. my goal is to prepare before the investigation starts, this involves knowing the nature of the assignment and activities, prepare the tools and personnel needed to properly investigate the incident. Additionally, understanding the skill-sets required to extract digital evidence will help build the appropriate team, assign roles to staff and supervisor, and ensure the forensic investigators have appropriate background to perform the extractions needed.

Investigating a cyberstalking case presents a unique set of challenges. Evidence can be found in digital form, so it can be protected from being lost or damaged, or the complete opposite can be true and it can be easily lost, damaged, corrupted, or rendered inadmissible in court due to flawed forensic gathering practices. It is important, with cases involving digital media that the same procedures be followed when it comes to collecting evidence. Chain of custody documentation must still be kept. The right software must be used to directly copy any hardware seized or searched for investigative purposes.

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

This manual is to assist forensic technicians who may be responsible for preserving electronic crime scene and recognizing, collecting, preserving, and storing digital evidence. When dealing with digital evidence, these principles apply: The process of collecting, securing, and transporting digital evidence should not change the evidence in anyway. Only trained forensic technicians specifically for digital evidence should conduct the analysis. Everything done during the search, seizure, transportation and the storage of the digital evidence should be documented, preserved and ready for review.