Chapter 19: Forensic Computing

Bitstream data copy

Duplicates all data in a cluster, including anything that is in the slack space and unallocated space where digital forensic evidence may be hidden. A copy may not retain digital evidence.

Closed-circuit television (CCTV)

A system of cameras installed primarily for surveillance purposes

Digital evidence

Evidence in digital form such as the contents of a hard disk drive, a DVD, or a memory stick.

Internet service provider (ISP)

A company or other entity that provides Internet service to a given computer.

Photogrammetry

The use of digital images or photographs to determine characteristics and dimensions of objects in the images.

Data admissibility, hidden documents, the computer being chock ful of absolutely any information

What are the major challenges investigators confront with digital and electronic evidence in the new electronic crime scenes?

Secure the crime scene, disconnect the electronic from wifi and bluetooth, protect the electronic

It is generally accepted as good police practice that, when entering an electronic crime scene, the investigator should follow certain guidelines; identify and discuss these guidelines.

failing to obtain proper search warrants to search the device & mishandling data by not following proper procedures

Computer crime cases involve a level of complexity that requires the investigator to possess knowledge of both legal requirements and procedural requirements for effecting search and seizure of evidentiary material. Identify the most common mistakes made by the investigator.

By creating a bitstream data copy of it

Describe how the forensic computer investigator collects evidence from a hard drive.

so you have a copy that can be edited as you like and a hard copy that shows exactly what was on the hard drive and how it was

Why should a bitstream copy of the original storage medium and an exact duplicate copy of the original disk be made?

Yes; through cross-drive analysis by comparing contents of multiple hard drives to identify deleted or missing files

In the analysis of digital evidence, is it possible to recover deleted files? If so, describe the process one would have to consider using.

cyber fraud, identity theft, hacking, online harassment, distribution of illegal media

Identify the typical cases with which investigators will be involved when the computer is used as an instrument in criminal activity.

malware attacks, identity theft, data breach, fraud

When the computer is a target of criminal activity, what types of cases is the investigator most likely to encounter?

Ensure the position is correct, lighting is correct, and measurements are accurate

Which precautions should be taken for 3D reconstructions?

extracting 3D info about an object by taking multiple photos at different angles and in different lighting, then using specialized software to enhance and analyze these images

Discuss the process of photogrammetry.