Guide to Computer Forensics and Investigations

Kessler - Forensic Science Communications - January 2004: "Guide to Computer Forensics and Investigations

Computer and network forensics is such a multidisciplinary topic that the first hurdle is determining what the primary focus should be. I prefer a book that focuses on technology, providing procedures and guidelines that explain both how and why. Providing the appropriate elementary computer science and data communications background is essential if a book is to provide a good educational foundation for the subject.

Legal aspects are also essential because cyberforensics examiners must be well versed in the laws that guide their work. However, not all computer forensics is the purview of law enforcement, so I come back to preferring the technical focus. Given this bias, the Guide to Computer Forensics and Investigations is the best book that I have found. Although a relatively new field, the number of books on cyberforensics has grown dramatically in the last few years."

DNA from a Computer Keyboard

Forensic Science Communications - July 2004: "DNA from a Computer Keyboard

"[S]amples taken from trace evidence (i.e., hair and skin) found in a computer keyboard. The purpose was to determine whether more than one person had used the computer. A commercial kit was used for the extraction and purification of DNA and was found to be effective. Three STR loci were amplified (D18S535, D1S1656, and D10S2325) using polymerase chain reaction. The results indicated the existence of DNA in the samples from more than one person."

Validity of Computer Forensic Sciences

Scientific Validity of Computer Forensic Evidence: "Validity of Computer Forensic Evidence

Valid and reliable methods to recover data from computers seized as evidence in criminal investigations are becoming fundamental for law enforcement agencies worldwide. These methods must be technologically robust to ensure that all probative information is recovered. They must also be legally defensible to ensure that nothing in the original evidence was altered and that no data was added to or deleted from the original. The forensic discipline of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media is computer forensic science."

Examining Computer Evidence

Examining Computer Forensic Evidence: "Examining Computer Evidence

Computer evidence represented by physical items such as chips, boards, central processing units, storage media, monitors, and printers can be described easily and correctly as a unique form of physical evidence. The logging, description, storage, and disposition of physical evidence are well understood. Forensic laboratories have detailed plans describing acceptable methods for handling physical evidence. To the extent that computer evidence has a physical component, it does not represent any particular challenge. However, the evidence, while stored in these physical items, is latent and exists only in a metaphysical electronic form."

Goals in Recovering and Examining Computer Forensic Evidence

Goals in Recovering and Examining Computer Forensic Evidence: "Common Goals

These dissimilarities aside, both the scientific conclusions of traditional forensic analyses and the information of computer forensic science are distinctive forensic examinations. They share all the legal and good laboratory practice requirements of traditional forensic sciences in general. They both will be presented in court in adversarial and sometimes very probing proceedings. Both must produce valid and reliable results from state-of-the-art procedures that are detailed, documented, and peer-reviewed and from protocols acceptable to the relevant scientific community (ASCLD/LAB 1994)."

Computer Forensic Results

Recovering and Examining Computer Forensic Evidence: "Forensic Results

Forensic science has historically produced results that have been judged to be both valid and reliable. For example, DNA analysis attempts to develop specific identifying information relative to an individual. To support their conclusions, forensic DNA scientists have gathered extensive statistical data on the DNA profiles from which they base their conclusions. Computer forensic science, by comparison, extracts or produces information. The purpose of the computer examination is to find information related to the case. To support the results of a computer forensic examination, procedures are needed to ensure that only the information exists on the computer storage media, unaltered by the examination process. Unlike forensic DNA analysis or other forensic disciplines, computer forensic science makes no interpretive statement as to the accuracy, reliability, or discriminating power of the actual data or information."

Recovering and Examining Computer Forensic Evidence by Noblett et al. (Forensic Science Communications, October 2000)

Recovering and Examining Computer Forensic Evidence: "Computer Forensic Science

Computer forensic science was created to address the specific and articulated needs of law enforcement to make the most of this new form of electronic evidence. Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media. As a forensic discipline, nothing since DNA technology has had such a large potential effect on specific types of investigations and prosecutions as computer forensic science."

Image Scan Training (IMSCA)

Image Scan Computer Analysis: "Image Scan Training (IMSCA)

The Federal Bureau of Investigation's (FBI) Computer Analysis Response Team (CART) developed the Image Scan system to help investigators locate the presence of picture files that may contain contraband on a computer. This system allows the investigator to view a variety of graphic formats during a consensual search, and protects valuable digital evidence by booting up a computer using the Linux operating system.

After mounting the hard drive in a "read only" manner, Image Scan prompts the investigator to search for picture files only. During this process, the tool logs every step taken by the investigator, further documenting what occurred during the search process."

Regional Computer Forensics Laboratory

"What is an RCFL?

An RCFL is a one-stop, full service forensics laboratory and training center devoted entirely to the examination of digital evidence in support of criminal investigations, such as, but not limited to:

Terrorism
Child pornography
Crimes of violence
The theft or destruction to intellectual property
Internet crimes
Fraud. "

Free Photo Recovery to Katrina Victims

"As Gulf Coast residents begin the cleanup process after the recent hurricanes, there are many possessions that people will go to great lengths to salvage. Among those possessions with the most sentimental value are family photos, stored either in traditional albums, or for digital photos, on computer hard drives, CDs and DVDs. While CDs and DVDs could be easily transported before the storms arrived, many people did not have the option of saving photos that were stored only on hard drives. In order to help them with the rebuilding process, Ontrack Data Recovery, the industry�s leading data recovery company, is teaming up with the Optical Storage Technology Association (OSTA) to provide home users affected by the hurricanes with free recovery of digital photos in the .JPG format through the end of November. "

Free Photo Recovery Information Courtesy of CentralLaw.com