Monday, March 05, 2007
Computer Forensics: When looking at the bigger picture of the computer
forensics investigation there are three main areas of action that must
take place for a successful investigation. The three main actions are
to acquire and preserve the data, analyzing the data and then preparing
The first step is to
forensically acquire and preserve the electronic evidence. This
requires many specialized tools in or to practice sound forensic
techniques. Although these tools are often cost prohibitive to many
individuals and or companies, without them the forensic investigation
would be compromised and would never hold up in a court of law. For the
digital evidence be valid, it must be preserved in its original form.
There are two different ways to do this. It can be done by creating a
mirror image with software application or utilizing hardware devices.
Software acquisitions create a forensically sound image that makes no
changes to the information on the subject hard drive. As where hardware
acquisition tools duplicate drives or allow read only access to the
subject drive. The forensic image must be identical to the original no changes should be made to the evidence.
next step in the forensic process is to analyze the preserved
electronic image. During the analysis phase of the computer forensic
investigation there are many steps. The steps taken are usually
dependent on what the investigator is looking for. The analysis of the acquired data is the most time consuming part of a Computer Forensic investigation.
Following the analysis of the electronic data the investigator
must be able to present the findings in manner that allows the public
to understand the findings. If the case in question has to be taken
into a court of law the attorney presenting the information must be
able to relay it to the audience. This is a critical part of the
process. If the information cannot be digested then it is of no use to
the user. Many of the high end computer forensic software with help the
investigator prepare the report in the proper format.
The above illustrates only some of the main points that must be performed in a properly conducted computer forensic investigation.
Without the specialized tools and procedure not many investigations
companies are properly set up to perform computer forensics