Computer Forensics Information Guide

Computer Forensics

Computer forensics - also known as digital forensics and cyber forensics - relates to the application of analytical techniques employed to collect, recover, authenticate, preserve and analyse electronic data for legal purposes.

Applied forensic computing comprises four main stages, namely:

Identifying sources of digital evidence.
Securing and preserving identified evidence.
Analyzing the evidence.
Documenting legally admissible evidence.

Want To Study Forensics/CSI?

Computer-forensics world notes the most common situations in which computer forensics is employed include:

Accidental or deliberate unauthorized disclosure of corporate data.
Employee internet abuse.
Damage assessment and analysis.
Industrial espionage.
Criminal fraud and deception cases.

Insightful talk by Davin Teo discussing his work as a digital forensic investigator.

Digital Evidence

According to the National Institute of Justice, digital evidence is information and data of value to an investigation that is stored on, received, or transmitted by an electronic device. This evidence is acquired when data or electronic devices are seized and secured for examination.

Digital-evidence is:

Latent, like fingerprints or DNA evidence.
Crosses jurisdictional borders quickly and easily.
Is easily altered, damaged, or destroyed.
Can be time sensitive.

It is important to remember that digital evidence may also contain physical evidence such as DNA, fingerprints, or serology. As such, physical evidence should be preserved for appropriate examination.

The Critical Role of First Responders in Collecting Digital Evidence

As technology advances, so have the knowledge and duties required of law enforcement officers at a crime scene. The scope of evidence to be searched for and collected at a crime scene now includes digital-evidence such as cell phones and computer networking devices. Some of these devices might be hidden in ceilings or other locations that are not immediately evident.

At the same time, forensics experts face an ever-expanding backlog of digital-evidence due to the increased use of computers. Training and preparing first responders to perform preliminary investigations could help reduce the digital-evidence backlog and help law enforcement make significant headway into solving a range of crimes, including:

Computer Threats.
Missing Person Cases.
Fraud Cases.
Theft.

Onsite analysis by first responders would speed up initial investigative tasks, reducing the workload of digital forensics experts and allowing them to focus on more in-depth digital-evidence analysis.

Essential Reading

An Updated Edition of the Definitive Computer-Forensics Text:

Updated to include the most current events and information on cyberterrorism, the second edition of Computer- Forensics: Cybercriminals, Laws, and Evidence continues to balance technicality and legal analysis as it enters into the world of cybercrime by exploring what it is, how it is investigated, and the regulatory laws around the collection and use of electronic evidence.

Students are introduced to the technology involved in computer forensic investigations and the technical and legal difficulties involved in searching, extracting, maintaining, and storing electronic evidence, while simultaneously looking at the legal implications of such investigations and the rules of legal procedure relevant to electronic evidence. Significant and current computer forensic developments are examined, as well as the implications for a variety of fields including computer science, security, criminology, law, public policy, and administration

See following link for full details.

Computer-Forensics: Cybercriminals, Laws, and Evidence