ACC 427 4-2 Short Paper- Forensic Computer Evidence

docx

School

Southern New Hampshire University *

*We aren’t endorsed by this school

Course

427

Subject

Accounting

Date

Nov 24, 2024

Type

docx

Pages

Uploaded by Barbara8289

1 Forensic Computer Evidence Harriet Creyer 4-2 Short Paper: Forensic Computer Evidence Southern New Hampshire University ACC 427 Investigating with Computers

2 Forensic Computer Evidence Forensic Computer Evidence Based on the material from the "U.S. Department of Justice Forensic Examination of Digital Evidence: A Guide for Law Enforcement" document, explain some important parts of the computer forensic process. Digital Forensics or computer forensics is important as it helps within investigations and to assist in solving crimes that involve technology. Parts of this process involve the collections, preservation, analysts, and presentation of any digital evidence that would be used in court. What are some of the key considerations for an "on-site" examiner, also known as a "first responder"? The on-site examiner also known as a ‘first responder’ is responsible for ensuring the crime screen is correctly secured both before and during the gathering of evidence. They also need to be able to consider the safety of the personal at the scene during this time. Some of the key considerations of the first responders to the scene would be to Identify the number, the types of computers and possibly the network in which the computers use. “Identify and document the types and volume of media, including removable media. Document the location from which the media was removed.” ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004). It is also essential that they identify any offsite storage and any potential remote locations for both computers and storage of these devices. These steps as well as a few others are essential in starting each investigation, while securing the crime scene it allows no questions that

3 Forensic Computer Evidence the evidence was moved or tampered with at the start and correct procedures were followed to allow this. If anyone feels that the crime scene wasn’t correctly secured it could potentially throw the entire case out. ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004) What are two attributes of a timestamp that could be located on a computer system? (List and explain.) Time frame analysis can be useful when it comes to determining when certain events occurred within a computer system. It “can be used as a part of associating usage of the computer to an individual(s) at the time the events occurred.” ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004). These two methods associated with Time frame analysis are: 1. Reviewing the time and date stamps within the system will include the date the file was last modified, the date it was last accessed, when it was created and if there was any change to the status; this is known as the metadata of a file. This can enable us to link all the files of interest and relevant to the case together. ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004) 2. Reviewing the system and application logs to identify any time or date stamps that might be present, these could include “error logs, installation logs, connection logs, security logs, etc.” ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004). For example, when a password and or

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

4 Forensic Computer Evidence username was changed within a system, or when a user last logged on. When documenting and reporting a computer forensic examination (investigation), what are some common notes that should be maintained? (List and explain.) When the examiner processes evidence it is essential that they make notes along the way to categories their thoughts about what they are seeing and potentially uncovering. Some of these notes must be detailed enough to potentially be duplicated by another person and allow them to get the same results. They must also include the date, time, and full descriptions of what occurred during this process, this allows for a ‘play by play’ to be ‘visualized’ when it comes to their findings. There needs to be significant information regarding the processes used as well as any network or software changes used within the examination, along with any changes there needs to be detailed reasons as to why the changes were made. All of this whilst maintaining proper chain of custody and any information pertaining to the acquisition of evidence. ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004). Not only will detailed and meticulous notes help the examiner stay organised, but it will also ensure a thorough investigation, and allow for little questionability regarding the evidence and the information found. What are the four major steps to completing the processing of digital evidence? 1. Assessment: Digital evidence should be thoroughly assessed to determine the “course of action to take” ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004).

5 Forensic Computer Evidence 2. Acquisition: “Digital evidence, by its very nature, is fragile and can be altered, damaged, or destroyed by improper handling or examination” ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004). Duplicates are the best course of action, and the original evidence needs to be preserved. 3. Examination: To be able to “extract and analyse digital evidence” ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004). The ‘removal’ and explanation of the data allows it to be put into a useable form for all. Only persons trained in digital forensics should be conducting examinations on this evidence. 4. Documenting and Reporting: Actions and thoughts must be documents throughout the entire process. Documentation and reporting of all information found during an investigation is ongoing and will only really stop when the case is closed. It is important to record the steps taken. ( Forensic Examination of Digital Evidence: A Guide for Law Enforcement 2004).

6 Forensic Computer Evidence References Forensic Examination of Digital Evidence: A Guide for Law Enforcement. (2004, April). https://www.ojp.gov/pdffiles1/nij/199408.pdf

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version