Technology And The Recovery Of Forensic Evidence

During this period the science of digital forensics grew out of ad-hoc tools and techniques developed by these hobbyist practitioners. This is in contrast to other forensics disciplines which developed from work by the scientific community.[1][13] It was not until 1992 that the term "computer forensics" was used in academic literature (although prior to this it had been in informal use); a paper by Collier and Spaul attempted to justify this new discipline to the forensic science world.[14][15] This swift development resulted in a lack of standardization and training. In his 1995 book, "High-Technology Crime: Investigating Cases Involving Computers",

“In 2003, two students from MIT bought 158 used and formatted disk drives from a wide variety of locations. From there they were able to extract over 5,000 credit card numbers, secret corporate financial information, detailed personal and medical information, along with many gigabytes of personal emails and pornography” (Sherweb, 2010, para 2). Computer forensic tools are used to find out and analyzing available, deleted, or hidden information that may be used for evidence in a legal matter. These forensic tools allows the user to uncover potential evidence that someone else does not want to be discovered. This

Specialized techniques for data recovery, evidence authentication and analysis of electronic data far exceeding normal data collection and preservation

By performing the tasks required in this lab, many other attributes, references, and system information was gleaned that will benefit forensic efforts in the future. For this lab, the time zone of the computer has been isolated to China Standard Time, which in itself is suspicious. BHOs and add-ins were also located using registry values. Among this, there was only a reference to Bing Bar, which was identified in an earlier lab as a download performed on Jane’s computer. Moreover, this lab uncovered startup applications (UPnP.exe and SCVHhost.exe) that were identified as potentially suspicious in previous labs. Lastly, this lab allowed the student to locate USB storage devices that were connected to Jane’s system as well as the times associated with the connection and removal of the device in the system’s

2. Explain, from a forensics perspective, the digital evidence found on the Anthony family computer

Review the information in the text sheet entitled “Overview of Evidence and Digital Forensic Analysis Techniques,” which describes different types of digital forensic analysis techniques, such as disk forensics and e-mail forensics.

What potential sources of digital evidence do you find at a crime scene? First of all, what is digital evidence? Digital evidence is any information or data of value to an investigation that is stored on, received by, or transmitted by an electronic device. Also, Digital evidence or electronic evidence is any probative information stored or transmitted in digital form that a party to a court case may use at trial. Text messages, emails, pictures and videos, and internet searches are some of the most common types of digital evidence. Most criminals now leave a digital trail;

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

* Examine drives for evidence by running keyword searches and checking URL’s for Internet searches.

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Computers are common tools used by the culprits behind white-collar crimes. In order to find “culprits,” the forensic accountant will need to be able to dig deep into the company’s computer system. However, without the proper equipment, that process can prove to be very difficult. To facilitate the preservation, collection, analysis, and documentation of evidence, forensic accountants can use specialized software and computer hardware.

Every criminal investigation starts off the same way: A crime was committed, someone informs the police, law enforcement shows up, secures the crime scene and they start the investigation. There are steps taken in every investigation. Police interview witnesses, check surveillance, interrogate suspects; however, one of the most important steps is the collection and analysis of evidence. According to the Encyclopedia of Criminology (2014), forensic evidence refers to the verbal statements and physical items presented to a neutral fact-finder in the court of law that assist him or her in rendering a verdict (Vandenberg, 2014). In simple terms, it is anything offered to a court to demonstrate if the suspect on trial is guilt or innocent.

It is indisputable that the advancement in technology and knowledge has greatly improved the capability to catch criminals. Forensics of the past did not include the tools or knowledge that we now have. Although forensics is not a perfect science nor has it ever been, we are closer to perfecting it than ever. Every criminal leaves behind some traces of evidence; it is up to the professionals to find and analyze it to solve cases. Looking at the timeline of forensics technology of the past to the present it is evident that it has evolved dramatically and will continue to do so.

The aim of this report is to investigate where and how anti-forensic tools work as well as looking at the challenges forensic investigators are faced when such tools are used. After anti-forensic tools are used certain artefacts will be left behind, this report will also cover the procedures and difficulties when trying to uncover these artefacts as well as the tools used to find them.

In simple terms, computer or digital forensic evidence analysis is the scientific collection of data that is either retrieved or held by a computer storage device that can be used against a criminal in a court of law. For the information to be used in court it should be collected before it is presentation; therefore, there are a number of recommendations proposed to make sure that information collected meets the intended integrity.