Computer Forensics

The field of computer forensics was developed primarily by law enforcement personnel for investigating drug and financial crimes. It employs strict protocols to gather information contained on a wide variety of electronic devices, using forensic procedures to locate deleted files and hidden information.

Computer forensics tasks include capturing all the information contained on a specific electronic device by using either a forensic copy technique or by making an image of all or a portion of the device. A forensic copy provides an exact duplicate of the hard drive or storage device. None of the metadata, including the าlast accessed date,ำis changed from the original. However, the copy is a าliveำversion, so accessing the data on the copy,even only to าsee what is there,ำcan change this sensitive metadata.

By contrast, making a forensic image of the required information puts a protective electronic wrapper around the entire collection. The collection can be viewed with special software, and the documents can be opened, extracted from the collection, and examined without changing the files or their metadata.

Other forensic tasks include locating and accessing deleted files, finding partial files, tracking Internet history, cracking passwords, and detecting information located in the slack or unallocated space. Slack space is the area at the end of a specific cluster on a hard drive that contains no data; unallocated space contains the remnants of files that have been าdeletedำ but not erased from the device, as าdeletingำ simply removes the pointer to the location of a specific file on a hard drive, not the file itself.

Electronic Discovery

Electronic discovery has its roots in the field of civil litigation support and deals with organizing electronic files using their attached metadata. Because of the large volume encountered, these files are usually incorporated into a litigation retrieval system to allow review and production in an easy methodology. Legal data management principles are used, including redaction rules and production methodologies.

Electronic discovery tasks usually begin after the files are captured. File metadata is used to organize and cull the collections. Documents can be examined in their native file format or converted to TIF or PDF images to allow for redaction and easy production.

Common Capabilities, Different Philosophies

Computer forensics and electronic discovery methodologies share some common capabilities. One is the ability to produce an inventory of the collection, allowing reviewers to quickly see what is present. Another is the ability to determine a common time zone to standardize date and time stamps across a collection. Without this standardization, an e-mail response may appear to have been created before the original e-mail.

Computers have radically changed the way we live your lives. Everyday living as become easier and technologically advanced decades ago. It has changed the way we work and the way we live in our houses. Children to day are sometimes even more technologically aware than their parents. Mobiles phones have gotten smaller and laptops have gotten slimmer.

With the launch of the Iphone that used the touch screen technology it will only be a matter of time when this idea permeates into other devices and appliances. Unfortunately, technology also makes it easier for criminals to their dirty job. However, computer forensics makes sure that technology is put to lawful use.

Everyone keeps up with the times, even the criminals. The internet is a public place which makes it vulnerable for fraud. Criminals often take advantage of unsuspecting victims. Law enforcement agencies have incorporated computer science in their investigation process to aid them with computer savvy criminals.

Crime and computers

We have seen a lot of Hollywood movies about hackers stealing from financial institutions. We have also seen two parties making their deals through bank transfers with a bunch of computers. Although these are not possible in real life, there are other ways that criminals can use computers.

Computer forensics is basically applying computer science to assist in the legal process. It entails the technological and systematic inspection of the contents of a computer system for evidence. Individuals in this field are called by different titles such as digital media analyst or computer forensics investigator. These people scanned a computer thoroughly to find out if they have used for a civil wrongdoing or criminal act.

The skills required are more than just normal data collection and using preservation techniques. Other definitions include the use of special tools to meet the Court’s criteria and not just a thorough examination of a computer for potential evidence. This definition is similar to Electric Evidentiary Recovery or e-discovery.

Most of the time computer forensic investigators investigate hard drives, portable data devices and data storage devices. These devices include USB Drives, Micro Drives and external Drives.

The first task of the computer forensic investigator is to find sources of documentary or digital evidence. The next step would be to preserve the evidence so that it could be analyzed later on. When dealing with computer systems, important files or data can be quickly lost.

The investigator should take the necessary test because data retrieval can be time consuming and costly. The investigator would then analyze the collected data for potential and supportive evidence. The final step would be presenting the findings. The investigator will render his opinion based on the examination and make a report.

The process of using computer forensics must comply with the standards of evidence that are acceptable in court. This field is both technical and legal. The investigator should also have a complete understanding of the suspect’s level of sophistication. If they don’t the suspects are assumed to be experts.

Investigators then presume that the criminal have installed a countermeasure to render forensic techniques useless. The computer will then be shutdown completely to prohibit the machine from making further modifications to its drives.

Computer technology has changed the way we live, work, and for others – commit crime. Although the internet may seem like a very convenient place users should always be wary for seemingly innocent offers.

What will you feel if you suddenly realize that one of your multi-million projects gets corrupted, it crashes, and then it burns? Sure enough, you will think that it is the end of the world for you. Just imagine how you and your staff have concerted your efforts just so the project will materialize and now that you are nearly feeling the glory of its completion, all of the data get lost.

Well, you can never tell as to whether the bits of information have been erased accidentally or on purpose because it is not for you to determine. Before you indulge yourself into feeling your world crashing under your own feet, better prefer to get in touch with the reliable individuals. In this case, there is only one person to turn to and it is none other than a computer forensics investigator.

The Nature of Computer Forensics Investigators

Computer forensics investigators are equipped with the necessary tools and techniques in recovering any lost data. Yes, there are cases when the employees themselves are to be blamed by the deletion of the file. The investigators are tasked not only to recover the erased data files but also to establish any guilt on the part of the employees should they be involved in any fraudulent activities like leaking sensitive company information to another party.

Commonly, computer forensics investigators are hired to uncover malicious acts. They are the ones who collect and then scrutinize the files for the purpose of establishing evidence to be presented before the courts of law.

Nowadays, the intelligence agencies, law enforcement, military, and other businesses deem it necessary to employ computer forensics investigators in light of the attempt of finding solution to crimes and other deceptive moves incurred by an individual.

The computer forensics investigators may either work in the laboratory or in the field. With them, files that have been deleted from one location of the computer system are tracked down and brought back in the most possible way of avoiding alterations to the original data.

Now comes in the skill and technique employed by the investigator to retain the authenticity of the information as they are transferred into another media for examination purposes.

The Computer Forensics Investigators’ Career

Computer forensics investigators deal with the revival of pertinent computer-related files as a point of the investigation. All of the details which are kept in any storage device such as the computer hard disk or compact disk are surfed. These people are the experts when it comes to identifying digital evidences and documentary sources.

The preservation, investigation, and the presentation of the data are all integral parts of their tasks. The overall goal of computer forensics is to get on with a structured manner of investigation to profoundly find out the exact reason of the flaw in the digital system and revealing what or who is to be blamed responsible for such.

Needless to say, many of the present day’s big corporations make it a point to employ project managers who are knowledgeable with the basic skills in computer forensics recovery because of the tantamount cases of lost company data. More so, the career options of the computer forensics investigators are so vast.

They can either work for an intelligence agency, in the military, or settle as computer forensics consultants. The computer forensics investigators’ options are all but rewarding.

Many thanks to tv reveals a lot of us currently have a concept of what forensics is. Although some scenes are not illustrated appropriately (examining specimens are much more exhausting and mentally draining pipes as a result of the continuous demand for focusing on details, they don’t look as simple as they remain in tv with diving video camera angles) they have offered us an idea on what they carry out in gathering proof.

Computer forensics is part of this examination. Due to the greater incidence of cyber crimes they are currently an essential component of the lawful process.

We currently have a concept on what they do. However a computer forensics task entails a great deal of treatments and also competence. Like any type of various other evidence electronic data can likewise be breakable and also damaged. There are specific steps to be followed to make certain that the data will certainly be collected without being tampered.

A day in the work of a computer system forensic expert

The initial point that an expert will do is to protect the data and also the device. The data can never ever be examined in the same system that it originated from so exact duplicates are made. Normally the information in a hard disk is duplicated to remove the info needed.

The collection procedure starts when the analyst takes a look at the surroundings of the device. Various other physical proof such as notes, disks as well as hard copies are likewise taken. Photos of the surroundings are likewise taken. The location is likewise analyzed for mobile storage space devices.

If the computer system is still operating the information will certainly be accumulated by analyzing its applications. Computers that are used for prohibited communications might not have all of the information kept in the disk drive. Information stored in Random Gain access to Memory will be shed if the computer is closed down so this action is necessary.

Open source devices are made use of to evaluate on online computers. Experts can additionally get an image of mapped drives and encrypted containers while they are on. The information from network links are recorded initially, then running applications, and last but not least from the Random Gain Access To Memory.

The computer system is then turned off carefully in such a way that it will not loose any kind of information. The technique made use of will depend in the computer and also the os it uses. If correct shut down is made volatile data can be shed. Pulling the plug is not recommended either since it may corrupt the file system and loose important information.

The analyst then checks for catch and photographs the setup of the system. A representation will certainly additionally be made including serial number and markings.

The analyst after that makes a specific replicate of the hard disk called Imaging. They frequently utilize hard disk drive copy machines or software imaging devices. This is done in market levels to make bit-stream copies of ever before component that comes to the user which can store data.

The initial hard disk is then mounted with a hardware create protection and sent to a safe storage space. After making a full and also accurate duplicate the duplicated data can currently be analyzed for evidence. Experts make use of formula to make certain that the imaging process is validated. Two algorithms are generally used in this procedure.

The expert then provides his point of view after that records whatever that was done. A report is made that contains all the searchings for of the analyst as well as whether or not it has been made use of in a prohibited task or criminal act.