What exactly is Computer Forensics?
Computer forensics is considered to be the use of analytical techniques to identify, collect, preserve, and examine evidence/information which is magnetically stored or encoded in media.
Why is Computer Forensics employed?
To provide digital evidence of a specific or general activity. The forensic investigation itself can be initiated for a wide variety of reasons. The most high profile cases are usually in the area of criminal investigation, or perhaps civil litigation, but forensic techniques can be of value in a wide variety of situations, including, simply tracking the steps taken when data has been lost.
How a forensic investigation is typically approached?
Very broadly, the main phases are sometimes considered to be:
- secure the subject system (from tampering or unauthorized changes during the investigation);
- take a copy of hard drive/disk (if applicable and appropriate);
- identify and recover all files (including deleted files);
- access/view/copy hidden, protected and temp files;
- study 'special' areas on the drive (for example, the residue from previously deleted files);
- investigate the settings and any data from applications and programs used on the system;
- consider the system as a whole from various perspectives, including its structure and overall contents;
- consider general factors relating to the users computer and other activity and habits, in the context of the investigation;
- create detailed and considered report, containing an assessment of the data and information collected.
Throughout the investigation, a full audit log of all activities willmaintained and recorded. It is not unreasonable to include this in the report.
What do I do if I have a machine that has evidence?
Turn off the computer call Executive Computer Forensic Services to image the hard drive on that computer to preserve all data on the drive -- both active and inactive (deleted) data – as of the current point in time will be captured. Do not boot the computer or use it in any way before our Computer Forensic specialist acquires the hard drive image.
