Title: 1. Understanding Computer Forensics
Course: IN 2005 Digital Forensics > Section: Module 1: Chapter 1 - Computer Forensics and Investigations as a Profession

Computer Forensics Versus Other Related Disciplines

1. Computer forensics investigates data that can be retrieved from a computer’s hard disk or other storage media.  Network forensics yields information about how a perpetrator or an attacker gained access to a network.
2. Data recovery involves recovering information from a computer that was deleted by mistake or lost during a power surge or server crash.  Typically, you know what you’re looking for.  Computer forensics is the task of recovering data that users have hidden or deleted and using it as evidence.  This evidence can be inculpatory (“incriminating”) or exculpatory.
3. Disaster recovery uses computer forensics techniques to retrieve information their clients have lost.
4. Investigators often work as a team to make computers and networks secure in an organization.  Use Figure 1-2 to illustrate your explanation.
5. Enterprise network environment refers to large corporate computing systems that might include disparate or formerly independent systems.
6. When you work in the vulnerability assessment and risk management group, you test and verify the integrity of standalone workstations and network servers.  Professionals in this group have skills in network intrusion detection and incident response.
7. Define litigation as the legal process of proving guilt or innocence in court.
8. The computer investigationsgroup manages investigations and conducts forensic analysis of systems suspected of containing evidence related to an incident or a crime.

A Brief History of Computer Forensics

1. By the 1970s, electronic crimes were increasing, especially in the financial sector.  Most law enforcement officers didn’t know enough about computers to ask the right questions or to preserve evidence for trial.
2. In the early 1980s, PCs gained popularity and different OSs emerged.  Disk Operating System (DOS) was available in many varieties.  Forensics tools were simple, and most were generated by government agencies. Use Figure 1-3 to illustrate your explanation.
3. By the mid-1980s, Xtree Gold appeared on the market and recognized file types and retrieved lost or deleted files. Norton DiskEdit soon followed and became the best tool for finding deleted files.
4. Mention that in1987, Apple produced the Mac SE, a Macintosh with an external EasyDrive hard disk with 60 MB of storage.  Use Figure 1-4 to illustrate your explanation.
5. By the early 1990s, specialized tools for computer forensics were available.  The International Association of Computer Investigative Specialists (IACIS) introduced training on software for forensics investigations and the IRS created search-warrant programs.
6. ExpertWitness, created by ASR Data for the Macintosh, was the first commercial GUI software for computer forensics.  ExpertWitness could recover deleted files and fragments of deleted files.
7. The introduction of large hard disks posed new problems for investigators.  Other software that was developed for computer forensics includes iLook and AccessData Forensic Toolkit (FTK).

Understanding Case Law

1. Since technology is evolving at an exponential pace, existing laws and statutes can’t keep up with the rate of change.

1. When statutes or regulations don’t exist, case law is used.  Case law allows legal counsel to use previous cases similar to the current one because the laws don’t yet exist. Each new case is evaluated on its own merit and issues.

Developing Computer Forensics Resources

1. You must be familiar with more than one computing platform, such as DOS, Windows 9x, Linux, Macintosh and current Windows platforms.

1. You should join as many computer user groups as you can.  The Computer Technology Investigators Network (CTIN) meets monthly to discuss problems that law enforcement and corporations face.  The High Technology Crime Investigation Association (HTCIA) exchanges information about techniques related to computer investigations and security.

1. User groups can be especially helpful when you need information about obscure OSs.

1. It is recommended that you build a network of computer forensics experts and other professionals and keep in touch through e-mail.  Outside experts can provide detailed information you need to retrieve digital evidence.