FBI Mission - Federal Bureau of Investigation - Cyber Investigations

Federal Bureau of Investigation - Computer Forensic Services:

"The mission of the FBI Cyber Division is to:

- coordinate, supervise and facilitate the FBI's investigation of those federal violations in which the Internet, computer systems, or networks are exploited as the principal instruments or targets of terrorist organizations, foreign government sponsored intelligence operations, or criminal activity and for which the use of such systems is essential to that activity;

- form and maintain public/private alliances in conjunction with enhanced education and training to maximize counterterrorism, counter-intelligence, and law enforcement cyber response capabilities; and

- until such time as a final decision is made regarding the future role and location of the National Infrastructure Protection Center (NIPC), the FBI will direct and coordinate the Center's mission to protect the Nation's critical information infrastructure and other key assets."

Computer Forensic Services

Computer Forensic - Federal Bureau of Investigation - Cyber Investigations

"The FBI plays two very important roles in cyberspace. First, it is the lead law enforcement agency for investigating cyber attacks by foreign adversaries and terrorists. The potential damage to the United States' national security from a cyber-based attack includes devastating interruptions of critical communications, transportation, and other services. Additionally, such attacks could be used to access and steal protected information and plans. The FBI also works to prevent criminals, sexual predators, and others intent on malicious destruction from using the Internet and on-line services to steal from, defraud, and otherwise victimize citizens, businesses, and communities.

Computer Forensics Services - Top Cyber Cop

"By CAROLYN SALAZAR

Paramus detectives investigating a money-laundering scheme had confiscated a computer they suspected held crucial evidence. But its hard drive apparently had been wiped clean. At the time, many North Jersey police departments lacked the technical savvy and financial resources to investigate crimes involving computers. So the Paramus detectives did what many investigators facing similar stumbling blocks did: They headed to Upper Saddle River. . . . Before long, Donofrio proved the laptop was used to spit out fraudulent store receipts, leading to theft convictions against several people. The U.S. Secret Service took up the case when the evidence showed it was also being used to counterfeit money. . . . Since then, the office's Computer Crime Unit has grown from one full-time detective to four. It oversees a 14-member task force made up of police officers from local departments. The unit, which investigates such crimes as child pornography, credit card fraud and hacking, has arrested about 100 people . . . ."

NorthJersey.com

Computer Forensics Services - Top Cyber Cop

Computer Forensics Gaffe | Channel Register

"Hey Greg, don't turn on the PC!

A team of computer forensic investigators has pointed out that a character in a recent episode of hit TV show CSI: Crime Scene Investigation failed to follow a basic rule of looking for evidence: don't switch on the computer. Experts at CY4OR, based in Bury, England, praised CSI for bringing computer forensics to the forefront of public awareness; but they say it does little to reflect the correct and essential procedures that must be put in place when there is suspicion of criminal activity. Experts at CY4OR, based in Bury, England, praised CSI for bringing computer forensics to the forefront of public awareness; but they say it does little to reflect the correct and essential procedures that must be put in place when there is suspicion of criminal activity."

Computer Forensic Services

Computer Forensic Service - Data disaster

Recovery in the Lab

"One of the premier government shops for this kind of data recovery is the Defense Computer Forensics Lab.

"We now have a hard-drive repair capability," said Robert Renko, special agent with the Air Force Office of Special Investigations.

OSI is the executive agency for the Computer Forensics Lab supporting the criminal investigative agencies of each military service, which have their own computer crime investigators. "

Computer Forensics Services - IT forensic investigators peer into the minds of criminals | TG Daily

"Westlake Village (CA) - The sheer number and volume of current storage devices can be tough for the average computer user to handle, but what about computer investigators that must look for criminal information? Criminals try to hide information on their 200 GByte harddrives and portable devices like an iPod or cellular phone, but computer forensic investigators can usually recover the data."

TG Daily

Computer Forensic Services - Multinational Corporate Hacking

Corporate Hacking - "The software installs itself as a Windows rootkit. That means it conceals its presence on the PC and could let an outsider commandeer the machine through IRC chat channels. The rootkit is a favorite tool of virus writers, spammers, identity thieves and now, apparently, large multinational record companies. It cannot be removed using the Windows Add/Remove Programs function. If you try to delete it manually, your PC may no longer recognize the disc drive, and you may have to reinstall Windows, just in case you didn't have enough other weekend projects. Macs and standalone disc players are not affected."

Computer Forensic Services Internet Attorney

Computer Forensic Services - Hacking

Computer Forensic Services - Hacking: "Computer Hacking: Peer-to-Peer networks also have been abused by hackers. Because these systems potentially expose your computer and files to millions of other users on the network, they also expose your computer to worms and viruses. In fact, some worms have been specifically written to spread by popular Peer-to-Peer networks. Also, if Peer-to-Peer software is not properly configured, you may be unknowingly opening up the contents of your entire hard drive for others to see and download your private information."

Computer Forensic Services - Child Exploitation and Obscenity

Computer Forensic Services - Child Exploitation and Obscenity: "Child Exploitation and Obscenity: The receipt or distribution of child pornography and unlawful obscenity over the Internet also is a serious Federal crime. The FBI cautions parents and guardians that, because there is no age restriction for the use of Peer-to-Peer services, pornography of all types is easily accessible by the many young children whose parents mistakenly believe they are only accessing music or movies. In fact, children may be exposed to pornography -- and subsequently lured by sexual predators -- even though they were not searching for pornography, as some network users deliberately mislabel the names of files for this purpose."

Computer Forensic Services Copyright Infringement

Infringement: "Copyright Infringement: It is a violation of Federal law to distribute copyrighted music, movies, software, games, and other works without authorization. There are important national economic consequences associated with such theft. The FBI has asked industry associations and companies that are particularly concerned with intellectual property theft to report to the FBI -- for possible criminal investigation and prosecution -- anyone that they have reason to believe is violating Federal copyright law. "

Computer Forensic Services Copyright Infringement

Federal Bureau of Investigation - Computer Forensic Services

Computer Forensic Services : "To Users of Peer-to-Peer Systems:
The FBI has undertaken a new initiative to educate and warn citizens about certain risks and dangers associated with the use of Peer-to-Peer systems on the Internet. While the FBI supports and encourages the development of new technologies, we also recognize that technology can be misused for illicit and, in some cases, criminal purposes. In an effort to help citizens learn how to protect themselves, this letter is being distributed and is posted on the FBI's web site."

Criminal Schemes - Computer Forensic Services

Computer Forensic Services - Cyber Investigations: "Criminal schemes included in this initiative include: criminal spam, phishing, spoofed or hijacked accounts, international re-shipping schemes, Cyber-extortion, auction fraud, credit card fraud, Intellectual Property Rights (IPR), Computer Intrusions (hacking), economic espionage (Theft of Trade Secrets), International Money Laundering, Identity Theft, and a growing list of ''traditional crimes'' that continue to migrate on-line."

Computer Forensic Services - Operation Web Snare

Federal Bureau of Investigation - Cyber Investigations: "Operation Web Snare represents a coordinated initiative targeting an expansive array of Cyber Crime schemes victimizing individuals and industry worldwide. This initiative highlights numerous investigations that have been successfully advanced through cooperation and coordination of law enforcement, and a growing list of industry partners.

Cases included in Operation Web Snare exemplify the growing volume and character of Cyber crimes confronting law enforcement, and also underscores the continuing commitment of law enforcement to aggressively pursue Cyber criminals, both domestically and abroad. Focused efforts to pursue Cyber criminals internationally, has led to the development of enhanced proactive capabilities in several countries, and numerous investigative successes highlighted within this initiative. The development of international resources is closely coordinated with the DOJ, the U.S. State Department and a growing list of E-Commerce industry partners."

Computer Forensic Services - Cyber Investigations

Computer Forensic Services - Federal Bureau of Investigation - Cyber Investigations: "The mission of the Cyber Division is to: coordinate, supervise and facilitate the FBI's investigation of those federal violations in which the Internet, computer systems, or networks are exploited as the principal instruments or targets of terrorist organizations, foreign government sponsored intelligence operations, or criminal activity and for which the use of such systems is essential to that activity; form and maintain public/private alliances in conjunction with enhanced education and training to maximize counterterrorism, counter-intelligence, and law enforcement cyber response capabilities; and until such time as a final decision is made regarding the future role and location of the National Infrastructure Protection Center (NIPC), the FBI will direct and coordinate the Center's mission to protect the Nation's critical information infrastructure and other key assets. "

Computer Forensic Services - Federal Bureau of Investigation - Cyber Investigations

Computer Forensic Services - "The FBI plays two very important roles in cyberspace. First, it is the lead law enforcement agency for investigating cyber attacks by foreign adversaries and terrorists. The potential damage to the United States' national security from a cyber-based attack includes devastating interruptions of critical communications, transportation, and other services. Additionally, such attacks could be used to access and steal protected information and plans. The FBI also works to prevent criminals, sexual predators, and others intent on malicious destruction from using the Internet and on-line services to steal from, defraud, and otherwise victimize citizens, businesses, and communities. "

Warning About Computer Forensics

Computer Forensics: "Computer Forensics is a complex science, by necessity requiring careful preparation, and procedural discipline. Taking the correct actions, in the right order, and recording evidence properly, are often as important as having underlying knowledge of the issue. It is an area in which it is all too easy to slip up: to make a costly error, or miss a vital step. The rate of technological change is not likely to reduce this risk."

Is there anything that should NOT be done during an investigation?

Computer Forensics World: "Definitely. However, these tend to be related to the nature of the computer system being investigated. Typically though, it is important to avoid changing date/time stamps (of files for example) or changing data itself. The same applies to the overwriting of unallocated space (which can happen on re-boot for example)."

How is a computer forensic investigation approached?

Computer Forensics World: "It's a detailed science. However, very broadly, the main phases are sometimes considered to be: secure the subject system (from tampering during the operation); take a copy of hard drive (if applicable); identify and recovery all files (including those deleted); access/copy hidden, protected and temporary files; study 'special' areas on the drive (eg: residue from previously deleted files); investigate data/settings from installed applications/programs; assess the system as a whole, including its structure; consider general factors relating to the users activity; create detailed report. Throughout the investigation, it is important to stress that a full audit log of your activities should be maintained."

What are the Common Computer Forensic Scenarios?

Computer Forensics World: "Examples include:

- Employee internet abuse (common, but decreasing)
- Unauthorized disclosure of corporate information and data (accidental and intentional)
- Industrial espionage
- Damage assessment (following an incident)
- Criminal fraud and deception cases
- More general criminal cases (many simply store information on computers, intentionally or unwittingly)"

What is Computer Forensics?

"There are a number of slightly varying definitions around. However, generally, computer forensics is considered to be the use of analytical and investigative techniques to identify, collect, examine and preserve evidence/information which is magnetically stored or encoded. "

Guide to Computer Forensics and Investigations

Kessler - Forensic Science Communications - January 2004: "Guide to Computer Forensics and Investigations

Computer and network forensics is such a multidisciplinary topic that the first hurdle is determining what the primary focus should be. I prefer a book that focuses on technology, providing procedures and guidelines that explain both how and why. Providing the appropriate elementary computer science and data communications background is essential if a book is to provide a good educational foundation for the subject.

Legal aspects are also essential because cyberforensics examiners must be well versed in the laws that guide their work. However, not all computer forensics is the purview of law enforcement, so I come back to preferring the technical focus. Given this bias, the Guide to Computer Forensics and Investigations is the best book that I have found. Although a relatively new field, the number of books on cyberforensics has grown dramatically in the last few years."

DNA from a Computer Keyboard

Forensic Science Communications - July 2004: "DNA from a Computer Keyboard

"[S]amples taken from trace evidence (i.e., hair and skin) found in a computer keyboard. The purpose was to determine whether more than one person had used the computer. A commercial kit was used for the extraction and purification of DNA and was found to be effective. Three STR loci were amplified (D18S535, D1S1656, and D10S2325) using polymerase chain reaction. The results indicated the existence of DNA in the samples from more than one person."

Validity of Computer Forensic Sciences

Scientific Validity of Computer Forensic Evidence: "Validity of Computer Forensic Evidence

Valid and reliable methods to recover data from computers seized as evidence in criminal investigations are becoming fundamental for law enforcement agencies worldwide. These methods must be technologically robust to ensure that all probative information is recovered. They must also be legally defensible to ensure that nothing in the original evidence was altered and that no data was added to or deleted from the original. The forensic discipline of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media is computer forensic science."

Examining Computer Evidence

Examining Computer Forensic Evidence: "Examining Computer Evidence

Computer evidence represented by physical items such as chips, boards, central processing units, storage media, monitors, and printers can be described easily and correctly as a unique form of physical evidence. The logging, description, storage, and disposition of physical evidence are well understood. Forensic laboratories have detailed plans describing acceptable methods for handling physical evidence. To the extent that computer evidence has a physical component, it does not represent any particular challenge. However, the evidence, while stored in these physical items, is latent and exists only in a metaphysical electronic form."

Goals in Recovering and Examining Computer Forensic Evidence

Goals in Recovering and Examining Computer Forensic Evidence: "Common Goals

These dissimilarities aside, both the scientific conclusions of traditional forensic analyses and the information of computer forensic science are distinctive forensic examinations. They share all the legal and good laboratory practice requirements of traditional forensic sciences in general. They both will be presented in court in adversarial and sometimes very probing proceedings. Both must produce valid and reliable results from state-of-the-art procedures that are detailed, documented, and peer-reviewed and from protocols acceptable to the relevant scientific community (ASCLD/LAB 1994)."

Computer Forensic Results

Recovering and Examining Computer Forensic Evidence: "Forensic Results

Forensic science has historically produced results that have been judged to be both valid and reliable. For example, DNA analysis attempts to develop specific identifying information relative to an individual. To support their conclusions, forensic DNA scientists have gathered extensive statistical data on the DNA profiles from which they base their conclusions. Computer forensic science, by comparison, extracts or produces information. The purpose of the computer examination is to find information related to the case. To support the results of a computer forensic examination, procedures are needed to ensure that only the information exists on the computer storage media, unaltered by the examination process. Unlike forensic DNA analysis or other forensic disciplines, computer forensic science makes no interpretive statement as to the accuracy, reliability, or discriminating power of the actual data or information."

Recovering and Examining Computer Forensic Evidence by Noblett et al. (Forensic Science Communications, October 2000)

Recovering and Examining Computer Forensic Evidence: "Computer Forensic Science

Computer forensic science was created to address the specific and articulated needs of law enforcement to make the most of this new form of electronic evidence. Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media. As a forensic discipline, nothing since DNA technology has had such a large potential effect on specific types of investigations and prosecutions as computer forensic science."

Image Scan Training (IMSCA)

Image Scan Computer Analysis: "Image Scan Training (IMSCA)

The Federal Bureau of Investigation's (FBI) Computer Analysis Response Team (CART) developed the Image Scan system to help investigators locate the presence of picture files that may contain contraband on a computer. This system allows the investigator to view a variety of graphic formats during a consensual search, and protects valuable digital evidence by booting up a computer using the Linux operating system.

After mounting the hard drive in a "read only" manner, Image Scan prompts the investigator to search for picture files only. During this process, the tool logs every step taken by the investigator, further documenting what occurred during the search process."

Regional Computer Forensics Laboratory

"What is an RCFL?

An RCFL is a one-stop, full service forensics laboratory and training center devoted entirely to the examination of digital evidence in support of criminal investigations, such as, but not limited to:

Terrorism
Child pornography
Crimes of violence
The theft or destruction to intellectual property
Internet crimes
Fraud. "

Free Photo Recovery to Katrina Victims

"As Gulf Coast residents begin the cleanup process after the recent hurricanes, there are many possessions that people will go to great lengths to salvage. Among those possessions with the most sentimental value are family photos, stored either in traditional albums, or for digital photos, on computer hard drives, CDs and DVDs. While CDs and DVDs could be easily transported before the storms arrived, many people did not have the option of saving photos that were stored only on hard drives. In order to help them with the rebuilding process, Ontrack Data Recovery, the industry�s leading data recovery company, is teaming up with the Optical Storage Technology Association (OSTA) to provide home users affected by the hurricanes with free recovery of digital photos in the .JPG format through the end of November. "

Free Photo Recovery Information Courtesy of CentralLaw.com