Tuesday, May 28, 2013

Computer Forensics 101

Computer forensics, a branch of forensic science, involves salvaging, analyzing and maintaining the integrity of digital or electronic evidence. Law enforcement calls in computer forensic specialists when a crime has been committed, when an employee is being investigated and for basic computer research for debugging and optimizing the performance of any electronic system. A computer forensic team salvages all electronic evidence relating to a case. It follows standards to ensure the data it collects is valid and analyzes and reports on the evidence.

Computer forensic activities are regulated to maintain the integrity of evidence. In the United Kingdom, evidence is only considered legally valid if it adheres to Association of Chief Police Officers regulations. An example of these regulations is the "Good Practice Guide for Computer Based Electronic Evidence," which states the following principles:
No data pulled from emails, computers, cell phones and the like may be altered in any way during the retrieval or evaluation process.
Anyone accessing original data must be qualified to do so and be able to explain the relevance of their actions.
An audit trail must be created and preserved and any third-party evaluation must provide the same conclusions.
The case officer is accountable for all laws and principles being strictly followed.

The latest computer forensic technologies enable salvaging data from damaged and destroyed electronic devices. Both defense and prosecution teams benefit from this advanced technology. Analyzing data from computers provides email information, including sent, received and deleted messages. Active and deleted computer files undergo scrutiny. SIM cards removed from cell phones can yield lists of dialed numbers, contact numbers, texts that include sent, drafted and deleted messages, locations where cell phones were last used and overseas network providers.

Analyzing Results

Computer forensic specialists analyze the data that they retrieve. They create reports that are used as evidence to prove or disprove legal accusations. A computer forensic specialist takes responsibility for analysis and reporting in a legal dispute and testifies in court on his findings. The conclusions drawn from computer forensic evidence often make or break a legal case. Good practice principles used for maintaining data integrity and salvaging are also used for the final analysis and report.