Investigating A Potential Data Breach On Corporation Techs

The protection of evidence is crucial as the evidence is used for court proceedings or forensic testing. There are many ways to protect evidence including; proper packaging, sealing, collecting and identifying items (The Physical Evidence Handbook 8th Edition). There are guidelines in which forensic scientists should follow in order to package evidence. Packaging evidence protects the integrity and continuity by keeping it safe so it is not contaminated, tampered with or altered. The protection of evidence also prevents the evidence from being lost and minimises deterioration (Terry Spear, John Rush, Jerry Massetti, Jim Weigand and Mark

Proper chain of custody procedures is paramount for the law enforcement and prosecutors involved with the case. In fact, a mistake or oversight as simple and unintentional as forgetting to sign the name of the person who was testing or transferring the evidence has all the capability of having a case thrown out or the defendant may be found not guilty.

Preserved and appropriately maintained custody of evidence through submission of evidence to the laboratory and evidence custodian for analysis and safekeeping.

A forensic technician is a person trained to examine evidence and report his/her findings to the proper authorities. The type of technology used by a forensic technician will vary depending upon the type of evidence he/she must process. Such technology includes, but is not limited to 3D facial reconstruction, magnetic fingerprinting, and high-speed ballistics photography (Becker, 2013). The types of evidence to be processed can range from distorted digital images, to comparing DNA samples, to determining bullet trajectories (Young & Ortmeier, 2011). Popular television shows, such as NCIS and CSI, have glorified the forensic sciences, while offering viewers a glimpse into the world of forensics.

When evidence is collected from a scene of a crime and goes to the forensic laboratory for examination it is called a chain of custody all personnel who handle the evidence must sign and date the evidence package to assure the court that it has not been contaminated and it is the same evidence recovered from the crime scene. It is important to try and keep the number of personnel who handles the evidence to a minimum because all those who handle the evidence must testify in court. A chain of custody usually includes the investigator who collects the evidence from the crime scene and the scientist who analysis the material. But also could

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

They offer forensic examination careers in biometric analysis, forensic response and scientific analysis. First, forensic examiners perform complex DNA casework for the Federal DNA Database and the Combined DNA Index System (CODIS). Second, there are many forensic response technicians who perform tasks such as forensic imaging and crime scene documentation. For example, forensic imaging professionals work within the Forensic Imaging Unit (FIU) to provide photographic processing and support services. Crime scene documentation technicians survey and record crime scenes through traditional methods and digital cameras with laser scanners. They reconstruct anything from plane crashes to bullet trajectories. Third, there are scientific analysis technicians who perform chemistry, firearms and trace evidence research and analysis. For instance, trace evidence technicians assess and identify trace materials that are transferred during violent crimes, such as soil, glass, fibers and

Forensic science technicians are vital on a crime scene because the collect and analyze physical evidence. Evidence is one of the most important factor of a crime scene because this puts in investigator a step ahead in finding the suspect of a crime. Crime scene specialists help to collect and preserve evidence in a crime scene. There are rules concerning the collection of data in order to preserve its natural state. For example, “all non-movable items, such as fingerprints, at a crime scene should be processed at the scene using gray powder, black powder, or black magnetic powder. Polaroid 665 black and white film loaded in a Polaroid CU-5 camera with detachable flash should be used to make one-to-one photographs of prints which do not readily lift.” (Schiro, n.d.) Also in the case where there is a computer involved, if it is turned on, it must not be turned off until all the information is properly collected and stored on a file for later use. DNA examiners usually search for anything that could possibly contain DNA. These include fingerprints, hair, blood, semen, bite marks, and dead skin found under fingernails. Tests can be done to determine whether the DNA is the victim’s own or the possible suspect. The coroner’s role is to certify the death of an individual and if unknown, to gain the identity of the victim. These agencies

The procedure should accomplish that each type of physical evidence, whether an intact object, pieces of an object, blood, glass, liquids, or gasses, must be collected, marked or tagged, packaged, transported, and stored properly to be later admitted in to evidence in court. The maintaining proper chain of custody is particularly important when the object is one that is not unique or when questions could be raised about changes in the condition of the object, unique or not. Upon arrival at a crime scene, the officer should first quickly determine if anyone is injured or needs medical treatment and, if so, summon the health professionals. Then the officer should survey the crime scene, quickly determine whom to interview, and move nonessential individuals out of the area. The crime scene area should be cordoned off or otherwise closed to nonessential individuals.

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

To maintain chain of custody, you must maintain evidence from the time it is assembled to the time it is shown in court. To sustain the chain of custody, and eventually show that the evidence has remained intact or in one piece. Crime scene specialists and prosecutors generally need service providers or specialist in this field who can testify:

Embezzlement is a common crime in large corporations, especially those where Chief Financial Officers (CFOs) operate under autonomy on fiscal activities. The organization that called upon us is huge in terms of personnel employed; however, their Information Technology (IT) department isn’t staffed or trained adequately for thoroughly investigating crimes of this nature. It is this reason the organization has reached out to the police department; where I hold the position as Chief of the digital forensics division, whose division with spearhead the investigation procedure. Capturing all the evidence used to commit crime will be tedious & complicated, but well within our sphere of capabilities (Nelson, Phillips, & Steuart, 2010, p. 14).

Provide customers and stakeholders with details about the identity theft and how they are affected by it

Since the widespread use of computers, computer crime has caused an increase in computer investigations during the twenty first century. Some reasons for investigation include: identity theft, such as stolen social security and credit card numbers, to find evidence of a cheating spouse, to investigate hackers on a computer system, to find evidence of child pornography, and much more.

The rest of the paper is organized into various different sections as follows. In section 2, we give a brief outline of the approaches for securing both the audit log files and well as the audit logs server along with other security mechanisms. The third section includes a brief study of how we can index and retrieve the data for any forensic investigation which may be quite essential in a fast paced criminal investigation. The fourth section discusses in depth about the use of the valuable information uncovered using log files and how they can help us find important patterns.