Examining Computer Evidence

Examining Computer Forensic Evidence: "Examining Computer Evidence



Computer evidence represented by physical items such as chips, boards, central processing units, storage media, monitors, and printers can be described easily and correctly as a unique form of physical evidence. The logging, description, storage, and disposition of physical evidence are well understood. Forensic laboratories have detailed plans describing acceptable methods for handling physical evidence. To the extent that computer evidence has a physical component, it does not represent any particular challenge. However, the evidence, while stored in these physical items, is latent and exists only in a metaphysical electronic form."

Goals in Recovering and Examining Computer Forensic Evidence

Goals in Recovering and Examining Computer Forensic Evidence: "Common Goals



These dissimilarities aside, both the scientific conclusions of traditional forensic analyses and the information of computer forensic science are distinctive forensic examinations. They share all the legal and good laboratory practice requirements of traditional forensic sciences in general. They both will be presented in court in adversarial and sometimes very probing proceedings. Both must produce valid and reliable results from state-of-the-art procedures that are detailed, documented, and peer-reviewed and from protocols acceptable to the relevant scientific community (ASCLD/LAB 1994)."

Computer Forensic Results

Recovering and Examining Computer Forensic Evidence: "Forensic Results



Forensic science has historically produced results that have been judged to be both valid and reliable. For example, DNA analysis attempts to develop specific identifying information relative to an individual. To support their conclusions, forensic DNA scientists have gathered extensive statistical data on the DNA profiles from which they base their conclusions. Computer forensic science, by comparison, extracts or produces information. The purpose of the computer examination is to find information related to the case. To support the results of a computer forensic examination, procedures are needed to ensure that only the information exists on the computer storage media, unaltered by the examination process. Unlike forensic DNA analysis or other forensic disciplines, computer forensic science makes no interpretive statement as to the accuracy, reliability, or discriminating power of the actual data or information."

Recovering and Examining Computer Forensic Evidence by Noblett et al. (Forensic Science Communications, October 2000)

Recovering and Examining Computer Forensic Evidence: "Computer Forensic Science

Computer forensic science was created to address the specific and articulated needs of law enforcement to make the most of this new form of electronic evidence. Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media. As a forensic discipline, nothing since DNA technology has had such a large potential effect on specific types of investigations and prosecutions as computer forensic science."

Image Scan Training (IMSCA)

Image Scan Computer Analysis: "Image Scan Training (IMSCA)



The Federal Bureau of Investigation's (FBI) Computer Analysis Response Team (CART) developed the Image Scan system to help investigators locate the presence of picture files that may contain contraband on a computer. This system allows the investigator to view a variety of graphic formats during a consensual search, and protects valuable digital evidence by booting up a computer using the Linux operating system.



After mounting the hard drive in a "read only" manner, Image Scan prompts the investigator to search for picture files only. During this process, the tool logs every step taken by the investigator, further documenting what occurred during the search process."

Regional Computer Forensics Laboratory

"What is an RCFL?



An RCFL is a one-stop, full service forensics laboratory and training center devoted entirely to the examination of digital evidence in support of criminal investigations, such as, but not limited to:



Terrorism

Child pornography

Crimes of violence

The theft or destruction to intellectual property

Internet crimes

Fraud. "

Free Photo Recovery to Katrina Victims

"As Gulf Coast residents begin the cleanup process after the recent hurricanes, there are many possessions that people will go to great lengths to salvage. Among those possessions with the most sentimental value are family photos, stored either in traditional albums, or for digital photos, on computer hard drives, CDs and DVDs. While CDs and DVDs could be easily transported before the storms arrived, many people did not have the option of saving photos that were stored only on hard drives. In order to help them with the rebuilding process, Ontrack Data Recovery, the industry�s leading data recovery company, is teaming up with the Optical Storage Technology Association (OSTA) to provide home users affected by the hurricanes with free recovery of digital photos in the .JPG format through the end of November. "



Free Photo Recovery Information Courtesy of CentralLaw.com