ipl-logo

How To Properly Conduct A Successful Computer Forensic Investigation

873 Words4 Pages
bulb-icon

Recommended: Quizlet computer forensics

As a security director for this large corporation, I understand that there are certain procedures that need to be followed in order to properly conduct a successful computer forensic investigation. The most important thing is to ensure that the chain of custody is maintained for any computer evidence found or recovered. From the moment you take possession of the evidence until the time the evidence is presented in a court of law you must be able prove who had possession of the evidence, when they had it and where the evidence was stored. Whenever evidence is found during a computer forensic investigation there are some simple steps that should be followed to ensure the evidence is preserved and usable in court. The first thing that a good investigator will do would be to take photographs of the subject’s computer and then take several other photos of the crime scene. If the suspected computer is off the investigator should not power that PC on. If the computer happens to be on the investigator …show more content…

It’s also important to make sure all documentation, instruction manuals and notes are collected. It is also best practice to document all of the steps that were used during the seizure. If all of the steps are followed, the evidence should be admissible when it’s time to present same in a court of law.
The investigator should always remember to tag all of the evidence when seizing hardware. The evidence tag should contain at least the date and time, the name of the investigator, there the item was found, any other facts that could be relevant, and all other information your name, the case number, where you found the item, and other facts relevant to the case. The final step would be giving the evidence to an evidence custodian after you tag and bag the evidence. (SANS,

Show More
Related
458 Words | 2 Pages

This would require that a detailed description be given of the data that is the content of the computer which may have been removed from the computer and stored

Read More
593 Words | 3 Pages

i. Manage The term manage is used to mean acquiring the necessary contractual vehicle and resources that include financial resources that are used in running forensic labs and programs. It can also be used to mean to coordinate and build internal and external consensus that can be used to develop and manage an organizational digital forensic program. Management also is to establish a digital forensic team, usually, the one that is composed of investigators, IT professionals and incidents handlers to perform digital and network forensics. Management provides adequate workspaces that at minimum take in to account

Read More
686 Words | 3 Pages

There were cameras in their apartment unit at the time of her death, the accused told the police how to operate the security system but did not tell them about the hard drive. By the time they knew about it, it was gone. The hard drive was brought to Court by Mr Craig McCoy. An IT consultant had been asked to examine it. There were no deleted files and the crown examined it to see if the hard drive had been reset at any time but couldn't find anything to support that idea.

Read More
620 Words | 3 Pages

During the comprehensive forensic examination Assante’s personal laptop was subjected to an eighteen hour intrusive search using specialized equipment to open and read all files on the laptop, scanning the unallocated space on the hard drive for deleted files, then proceeding to

Read More
1167 Words | 5 Pages

Presentation of Evidence: In order to try to prove guilt beyond a reasonable doubt, the prosecution will first present its case. This evidence may include witnesses, records, and forensic data. After then, the defence will get a chance to question the witnesses for the prosecution. Defense's Case:

Read More
724 Words | 3 Pages

The very first step after identifying and selecting the required computer forensics software our company needs, we need to test, verify, and validate the software otherwise the evidence we present would not be admitted in court. In the company, one of our main goals is to always follow the established standards set by federal agencies. For this purpose, when planning our procedure to validate our software, we must meet the standards set by the National Institute of Standards, and Technology, also known as NIST, which creates procedures and criteria for testing and validating computer forensics software and tools. In order to verify, test and validate the forensic software the company will be using we need to meet the criteria established by NIST in 2001 based on standard testing methods, the ISO 17025 criteria for items that have no current standards and the ISO 5725 criteria.

Read More
455 Words | 2 Pages

Where a crime is committed is referred to as a crime scene and everything is now considered evidence. Anything the police wrongfully handle, without taking something directly to an evidence compartment, or even leaving it out of sight can make the evidence invalid. This is because without the weapon or relevant surrounding object under direct supervision or properly locked up, it has the potential to be tampered with. Even the mere possibility of mishandled evidence renders it useless in any court

Read More
804 Words | 4 Pages

Cybercrime is a crime in which a computer is the object of the crime or tool used to commit a crime. Cybercriminals may use a computer for communication and documentation when perform such illegal activities, which could be used as electronic or digital evidence. Electronic or digital evidence is information stored or transmitted and it may be need in court. This evidence can be found on a hard drive, cell phone, digital camera, Internet software program, etc. One of the most elusive criminals, the BTK serial killer, was able to be captured and prosecuted due to a floppy disk.

Read More
499 Words | 2 Pages

In speaking to my brother in law, who is the Lieutenant of Investigations, at our local police department he made me aware that when a crime is committed, forensics are not always needed and if forensics are needed the department has to call in forensics, due to not having one on hand (Lt. R. Mitchell, 2016). I

Read More
659 Words | 3 Pages

The purpose of this phase is to collect more evidence about the crime, the victim and the cyber-stalker. The next process involved in the investigation of a cyberstalking case is the crime scene characteristics. You should first start by observing both the crime scene and cyber-trails. You should be on the lookout for distinctive features and try to conclude their importance to the cyber-stalker.

Read More
516 Words | 3 Pages

N. L. Beebe & J. G. Clark [73] designed a new model which was based on the principles decided at the starting of the investigation .According to this framework the investigation phases can be divided in hierarchical order. Figure 10: A Hierarchical, Objective-Based Framework for the Digital Investigation Process (HODIP) 4.13.2 Phases of HODIP All the phases listed in the framework has already been described in the above mentioned frameworks . 4.14 Computer Forensic Field Triage Process Model (CFFTPM) 4.14.1 Introduction M. K. Rogers, J. Goldman, R. Mislan, T. Wedge & S. Debrota [74] recommends an onsite approach to provide the identification, analysis and interpretation of digital evidence within a short time span without the urge to return the devices or media back to the lab. It also does not require taking the complete

Read More
580 Words | 3 Pages

Therefore, it is very important that a Digital Forensics Investigator knows that right way in acquiring data and

Read More
1723 Words | 7 Pages

Student Name: Keshab Rawal Student ID: 77171807 Word Count: Title: The rise of anti-forensics: The rise of anti-forensics: Tables of contents: • Overview • Introduction • History • Categories/Tools of anti-forensics • Conclusion • Future Work Overview: Computer forensics is an active topic of research, with areas of study including wireless forensics, network security and cyber investigations. The goal of the computer forensics is to provide information about how the crime happened, why and who is involved in the crime in any legal proceeding by using the computer forensic tools.

Read More
544 Words | 3 Pages

Computer forensics processes must adhere to standards set by the courtroom that often complicates what could have been a simple data analysis. In court, knowing who connected to the system based on logs is not enough. There must be facts that will support those connection

Read More
1915 Words | 8 Pages

During this process the investigators should carefully search for all forms of potential electronic evidence that they do have permission to take such as: USB (Universal Serial Bus) storage media, optical discs, mobile phones, tablets, laptops, SD (Secure Digital) and similar cards, NAS (Network-Attached Storage). Other forms of forensic evidence should be also considered such as: fingerprints and DNA before collection of devices, passwords, notes, paper documents, and other information relevant to the investigation. The process of dead forensic is simple, reliable and thorough.

Read More

More about How To Properly Conduct A Successful Computer Forensic Investigation

Related Topics

Open Document