Computer Forensics

scientific method of investigation and analysis in order to gather evidence from digital devices or computer networks and components which is suitable for presentation in a court of law or legal body

Types of Computer Forensics

Disk, Network, Malware, Email, Memory, Mobile Phone, Database

Difficulties encountered in attempting to locate and recover electronic evidence:

‒ Sheer volume of files stored on a computer
‒ Ability to move files quickly and easily anywhere in the world, hide files or store them on a remote server, encrypt files, misleadingly title files, commingle files with thousands of unrelated, innocuous files

Process

Identification, Preservation, Analysis, Documentation, Presentation

Hardware

Comprises the physical and tangible components of the computer

Software

A set of instructions compiled into a program that performs a particular task

Input Devices

Keyboard, Mouse, Joystick, Game Controller, Scanner, Camera, “Floppy” Disk Drive, CD/DVD/Optical Drive, External Hard Drive

Output Devices

Monitor, Printer, Speakers, “Floppy” Disk Drive, CD/DVD/Optical Drive, External Hard Drive, Network Router

Exigent Circumstances

no search warrant is required if entry is
necessary to prevent the destruction of evidence

Horton v. Cali

evidence may be seized if it is in plain
view to an officer while an unrelated search is being conducted

Throughout the entire process, the forensic examiner must adopt the method that is…

least intrusive

Visible data

that data which the operating system is aware of

Latent data

that data which the operating system is not aware of; can exist in both RAM and file sack or unallocated space

Slack space

the leftover storage space on a
computer's hard disk drive when a file does not need all the space it has been allocated by the operating system

Places where a forensic computer examiner might look to determine what websites a computer user has visited recently are:

‒ Internet cache
‒ Cookies
‒ Internet history

IP Addresses

provide the means by which data can be routed to the appropriate location, and they also provide the means by which most Internet investigations are conducted