Warning About Computer Forensics

Computer Forensics: "Computer Forensics is a complex science, by necessity requiring careful preparation, and procedural discipline. Taking the correct actions, in the right order, and recording evidence properly, are often as important as having underlying knowledge of the issue. It is an area in which it is all too easy to slip up: to make a costly error, or miss a vital step. The rate of technological change is not likely to reduce this risk."

Is there anything that should NOT be done during an investigation?

Computer Forensics World: "Definitely. However, these tend to be related to the nature of the computer system being investigated. Typically though, it is important to avoid changing date/time stamps (of files for example) or changing data itself. The same applies to the overwriting of unallocated space (which can happen on re-boot for example)."

How is a computer forensic investigation approached?

Computer Forensics World: "It's a detailed science. However, very broadly, the main phases are sometimes considered to be: secure the subject system (from tampering during the operation); take a copy of hard drive (if applicable); identify and recovery all files (including those deleted); access/copy hidden, protected and temporary files; study 'special' areas on the drive (eg: residue from previously deleted files); investigate data/settings from installed applications/programs; assess the system as a whole, including its structure; consider general factors relating to the users activity; create detailed report. Throughout the investigation, it is important to stress that a full audit log of your activities should be maintained."

What are the Common Computer Forensic Scenarios?

Computer Forensics World: "Examples include:

- Employee internet abuse (common, but decreasing)
- Unauthorized disclosure of corporate information and data (accidental and intentional)
- Industrial espionage
- Damage assessment (following an incident)
- Criminal fraud and deception cases
- More general criminal cases (many simply store information on computers, intentionally or unwittingly)"

What is Computer Forensics?

"There are a number of slightly varying definitions around. However, generally, computer forensics is considered to be the use of analytical and investigative techniques to identify, collect, examine and preserve evidence/information which is magnetically stored or encoded. "