G Essay

Digital forensics is a branch that is over the recovery and investigation of materials found in digital devices, it gives a better understanding of the situation. Back before the computers, researchers used to investigate the situation through eyewitnesses, evidences, and trying to recreate what happened in that area. Digital devices are everywhere this day and age. “Computers and networks have become so ubiquitous in our society, such an integral part of our daily lives, that any investigation or legal dispute will likely involve some form of digital evidence.” Casey, 2009 Introduction. Through electronics, it can store the needed evidence to be used in the future.

Digital crime has been on the increase due to the increasing use of computer and internet. This has led the investigators with another method of fighting this crime. This is Computer Forensics, a process of going into computer hard drive and capturing basic information the user believed it has been erased.

Mobile device forensics is the newest branch of digital forensics relating to the recovery of digital evidence or data from a mobile device under forensically sound conditions. The use of phones in crime was widely recognized for some years, but the forensic study

The amount of users on the Internet today and the possibility of each user utilizing multiple devices which are connected to the Internet can pose an enormous amount of work for a digital forensic investigator. A digital forensic investigator will almost always find the need to examine artifacts that are associated with the suspect or victim related to their activity on the Internet. A careful evaluation of the type of Internet activity related to the case in which the suspect is involved is an effective practice for the digital forensic investigator (Rogers, Goldman, Mislan, Wedge, & Debrota, 2006).

Over the last few years law enforcement has shown some major development and growth when it comes to forensic technology. The use of things such as cell phones, computers, gps devices has drastically increased. As a result, these devices regularly contain vital evidence, including user data, call logs, position, text messages, email, imageries and audio and video recordings. When it comes to cyber forensics, law enforcement has a substantial challenge in keeping current with technology changes. New technology is released onto the marked very quickly, both hardware and software. It is imperative that these agents know when these things will hit the market and how to use them. The enormous capacity of information contained on digital devices

Most people associate digital forensics with the investigation of a crime. However, in recent years it has also become the source of tools and methods used for protecting and analyzing data from the past. This paper is expected to provide a practical overview of a commercial software product used specifically for forensic investigation of mobile devices. A mobile device is a small computing device, generally small enough to be handheld, having a monitor with touch input and /or a miniature keyboard. The following are common examples of mobile devices: cell phones; smartphones, like Apple’s iPhone or Samsung’s Galaxy Note; GPS devices; and personal digital assistants (PDAs). Laptop computers, tablets and products that are not small enough

Also many software developers have extensively contributed towards the enhancement of digital forensics tools. These developments have resulted in divergent views on digital forensic examinations. This dissertation presents the CDFPM - Comparative Digital Forensic Process Model. The model is presented after analysing digital forensic process models within the current academic and law enforcement literature. An adapted sequential logic notation is used to denote the forensic models. The terminology used in different forensic models is examined and standardized to suit the CDFPM. Finally, a prototype supports complete selection of the CDFPM processes, which will aid a digital forensic

Digital forensics is the process of uncovering and interpreting electronic data for use in a court of law. The main goal of the process is to preserve any evidence in its most original form while performing a structured investigation by collecting, identifying and validating the digital information which will be admissible in a court of law. To collect the document has to follow certain guidelines. United States v. Gourde (2006) and United States v. Zeigler (2007) are both great examples of cases to investigate the case. The primary goal of this document is to demonstrate the importance of digital forensics in solving criminal investigation. In the following paragraph two criminal cases are studied and analyzed.

Cell phones have become an important part of everyone’s daily life in America. You can hardly find anyone over the age of 15 and younger than 80 years old these days without one. It is said that cell phones outsell personal computers 3 to 1. With numbers like that, it is important for law enforcement to understand the laws and resources needed to legally and properly conduct cell phone forensics to document, examine, and present for court purposes the evidence needed to substantiate a criminal case.

Therefore, the Golden Age created an important history of digital forensics – yet this vaunted past has been difficult for the present to keep up with, and Garfinkel is not certain that the future of digital forensics will match its past: “Without a clear strategy for enabling research efforts that build upon one another, forensic research will fall behind the market, tools will become increasingly obsolete, and law enforcement, military and other users of computer forensics products will be unable to rely on the results of forensic analysis” (Garfinkel, 2010, p. S64). Thus, it is clear that digital forensics is undergoing or must undergo a dramatic shift. Is this the case? The following literature review, which is subdivided into two main sections (i.e., statistical tools and processes and the future of digital forensics), seeks to evaluate the literature on this topic with an eye towards Garfinkel’s claims.

Four sources of data that stand out for forensic investigators in most criminal investigations are files, operating systems, routers and network traffic, and social network activity. Each data source presents a variety of opportunities and challenges for investigators, meaning that the more reliable data collection and analysis activity typically involves examination of a variety of sources. Digital forensics must cover the four basic phases of activity, which include: data collection, which describes the identification and acquisition of relevant data; data examination, which includes the processing of data through the use

A computer forensics expert can recover information and computer evidence even if it has been hidden, encrypted, or deleted. In computer forensics, time is of the essence and an investigation must be performed in a timely manner to prevent information from disappearing forever. An important aspect of a computer forensic investigation is that the computer forensics expert must be capable of performing the analysis in a manner that will preserve, identify, extract, document and interpret computer data. The computer forensics analysis must be performed in a manner that conforms with legal requirements so that the results of the forensics investigation will be admissible in court. Simply powering up a computer can result in many files being changed. This may affect the admissibility and reliability of digital evidence. The analysis of electronic evidence includes not only the analysis of documents currently in a computer and those that were previously deleted, but also past versions and alterations of electronically stored documents.

There are many tools available which can be used to analyze hard drives. There are tools that are approved for law enforcement and used in courts, there are other tools that are free to use, which some are made from law enforcement officers to help their investigations. There are many tools that can be used to recover deleted files and some tools have better success rates than others. There are many tools which can be used on mobile devices such as cell phones to gather digital evidence, the tools may have its own hardware to try to work with different types of phones and have different costs depending on the capabilities of the tool. Companies can higher specific certified computer experts for an hourly rate for digital forensic

Data is lost when an adversary cancels a cloud contract and a VM is powered down as a result. Real network and router logs cannot be gathered by the cloud customer for forensic purposes. Evidence is untrustworthy due to the cloud service provider (CSP) involvement in the collection of evidential data. Metadata is lost in the process of evidence gathering and the integrity of evidence data gathered cannot be verified. Another challenge is that evidence gathering has to be timely to prevent an adversary of destroying or modifying data in the time that the law enforcement agency (LEA) has to wait for search warrants due red tape of cross border investigations due to the distributed nature of cloud computing. Due to the elastic resources of cloud computing environments and increasing storage capacity of devices and computer systems, there is really no limit to storage capacity and the investigator is faced with the problem of gathering extremely large volumes of data placed in the cloud by cloud customers. The amount of forensic data to be processed is outgrowing the ability to process the data in a timely manner. The process of the evidence gathering in the cloud computing has become cumbersome and time consuming for the investigator and disruptive for the cloud customer. LEAs are increasingly finding that the data in question are either inaccessible or very difficult to access.

The paper ‘Cloud Computing Log Forensics- The new frontier’ talks about the complication when forensics is applied to the cloud.[1] Since there is no one to one mapping in cloud and cloud forensics involves evidence