Forensic Computing - Case Study Example

?Forensic Computing The end of 20th century saw a massive advancement in the field of forensics pertaining to the electronic use. Over the last decade the use of electronic means for committing felony has increased by large proportions and hence posing a serious threat to common people and their private lives. This includes internet in prime, the portable devices, information trackers, and other sources that could affect the individuals, organizations, and their assets. Computer Forensic is the best solution against all these acts and it enables a care free life. This involves data recoveries, retrievals, analysis, and tracing and decrypting of all the data that has been used in any deceitful activity. The word forensic is used in the context of legal argumentation. Forensic computing is also termed as digital forensics and cyber forensics. It is branch of forensics related to computer and other digital media. It involves collection, preservation and analysis of the data available on the computer .The definition presented by Computer Forensic world: the field primarily involves “use of analytical and investigative techniques to identify, collect, examine, and preserve evidence /information which is magnetically stored or encoded” (1). In other words, forensic computing deals with retrieval of data, and events reconstruction that were performed over the digital media. The scope of forensic investigation involves audio examinations, signal interpretation, repairing the damaged media. Photogrammetry is another aspect of digital forensic tracking that includes measuring and monitoring the physical measures of an image by making use of geometric formulae and then making a comparison based on on-site observations. Several factors come as constraints along with computer forensics and the first being the costs, since all the equipment used in these processes is high tech and state of the art, large investments are inducted into it. The second hurdle that could be faced by the forensic body is the approval and acceptance of all the proofs by the court. They must prove it to court that no information is altered and all the legal responsibilities have been fulfilled while conducting the operations. The staff inducted in digital forensic must be knowledgeable and should be able to think on many possibilities and should have knowledge beyond the books. Potential clues and areas that the forensic team would target DNA samples Voice samples Any image used in the process The network used for performing the task ( usually in case of credit card and bank accounts forgery) Finger prints on the electronic equipments Answering machines recordings Miscellaneous electronic equipment Introduction: The aim of forensic computing is to make online activities secure, stop illegal activities that are going on, identify and apprehend the guilty, avoid financial and personal damages to individuals and organizations that might be incurred by the online use. Standard procedures must be followed and all the evidence brought in front of the court must be in formal pattern that can stand as evidence. In case of actions warrants are obtained from the authorities for the areas and houses that are suspected of any wrong doings. A giant step in the direction of forensic computing was taken in 1984 when F.B.I Magnetic Media Program was created which was later converted into Computer Analysis and Response Team (C.A.R.T). F.B.I report for the year 2003 reported a total of $900,000 netted through computer crime (2).By 2003 F.B.I (C.A.R.T) were looking into 783 tera bytes of data as a case of forensic evidence and cases handling .In 1997 G8 ordered training of individuals for looking into matters related to online counterfeit activities .C.A.R.T provides assistance to F.B.I in tracking e-evidence and accessing the accounts and provides other technical support needed by F.B.I in conducting forensic activities. Part of C.A.R.T job is to monitor live activities that are going online. Their task is to provide monitoring in business environment including the banks and government owned organizations, insurance companies, personal accounts that contain the people’s private life and their safety concerned, corporate level that includes the annual reports, facts and data and institutes of any region whose data can be misused by any fraudulent activities performed online . International Association of Computer Investigation Specialists (IACIS), an international nonprofit organization that serves increasing awareness amongst people about computer forensics. Admissibility of evidence is an important element to keep in mind while performing the task. Admissibility is the fact that no rules have been violated as per privacy of the common citizen and all the procedures adopted are in accordance with the laws defined by the governing body of digital forensics. It also implies that the information so collected is not damaged, is in readable and retrievable form and it must be ensured that the collected information is in its original form. The roles of witness and juror must be clearly chalked out .Documentation must be performed for all the activities that are conducted during the online raids. Categories of forensic computer cases Internet misuse Illegal downloads Spyware analysis Spoofing and threatening emails Murder Virus and Trojan and other forms of Spam Forgery Pedophilic cases Credit card cloning The forensic department must have measures and means that ensure safety of all the data collected. Stenography is an important tool in this regard. Steg analysis is the art of hiding and covering the information in such a manner that it is not visible to the ordinary user, despite being present around. Techniques like water marking are also helpful in this regard. In other words, it is another way of encrypting the information and making it safe for further proceedings .The Steg Analysis alone includes human analysis, use of software, firewalls implementation and frequency matching and frequency jamming. In Contrast to ordinary forensic investigation computer forensic experts come up with direct evidence and data that can help confront the culprits .This requires the perseveration of information because the information so collected is fragile and can be easily erased and damaged since electronic equipment are sensitive most of the times. A computer holds a variety of datum that is either stored on processor. This part of datum constitutes the latent data, in other words, data that is not visible to the user and it contains the system files and logs, and the second form is the data that is in use of the users directly. This is called the active data and it contains the user files and configuration files. User created files Computer Created files Calendars Spreadsheets Address books Database files Cookies Backup files Event logs Hidden files Discuss: A case in this regard was observed in 2001 when an American company named Enron Corporation declared itself bankrupt, which resulted in large number of employees being laid off and fired. It was being speculated that a section of employees, mostly the top rank benefited from it. A Government level investigation was conducted into this matter and help of computer forensics was taken in order to investigate any apparent corporate misconduct on behalf of section of the staff. Specialized detective staff was brought in to check into the computer record of employees and look into the possible reasons for the bankruptcy and determine any wrong doings. Through their findings it was determined that the top officials had misled the board of directors on some serious issues. The forensic experts looked into all the wrong doings that were carried out during the scam and provided evidence against all those in court of law.(3) Another well known case that was solved successfully by Forensic Computing was of Sharon Lopatka, who was tortured and strangled to death in October, 1996. Forensic experts managed to recover emails and other data from her laptop, which led them to the murderer, Robert Frederick Glass. However, the emails also proved that the case which looked liked first degree murder was in fact a case of voluntary manslaughter, as proof existed that the victim contacted Glass herself. The purpose being sexual gratification, this case became a widely publicized example of consensual homicide by means of the internet. (4) Joseph E. Duncan III, a renowned serial killer who was convicted repeatedly and still managed to slip through the cracks in the system since 2007, is an ideal example of a case where forensic computing played a relevant role in solving a crime. Since 1978, this murderer had been dodging the law until in 2005, when he was apprehended by the police in a very public investigation pertaining to two kidnapped children, Sashta, aged 8 and her brother Dylan, aged 9. While Sashta was recovered alive, in critical condition, her brother had been brutally murdered. Due to Forensic Computing, a panel of 3 forensic experts was able to testify against Duncan with proof found in his laptop, including a detailed plan of the act, as well as video tapes of him physically abusing both children, and finally taking the life of one. Duncan has therefore been charged with first degree murder. (5) In the recent past a case came to forefront where computer forensics was used. World Renown Pop star Michael Jackson was charged with charges of physical harassment of the children prosecutors conducted digital forensic tests to verify the records and check the possibility of pornography being displayed on the digital equipment. A variety of tools are used for accomplishing the task and this involves the state of the art technology and huge investments .Special trainings are provided to the staff for retrieval of all the small clues that could lead to the perpetrators .Computer investigation involves keyword searches, password tracking, and source code decrypting. In a broader perspective, it includes Computers, while in narrow scope it ranges from portable drives to MP3 players to U.S.B drives. Computer alone can be used in multiple ways in the crime scene. The first, use of computers for performing a crime, second, computers can be used as an evidence to reach the culprit, and the third way, computer is the object to aim by the culprit. Two sections of the computer are highly prone to attacks by the intruders, one is the user created files and other is the computer created files on the system. Forensic experts can be employed to perform tasks that may include retrieval of deleted messages from a particular account, the alterations performed in any image or video, thereby checking its source code, in case of very high turnout in an election, the checking of ballots, other financial scams that involve transactions carried out online through anonymous email ids. Computer Forensics is divided into four steps based on the operations performed in accomplishing the objectives. It involves the following steps: Acquisition: this is the initial step in investigation and it involves possession of all the physical evidence or online accounts and by this stage the probing authority has all lawful approach to access and confiscate any data that is suspect full. Identification: This step involves testing and running the software and tools over the data confiscated and further identifying what data could be used to get to objectives. Evaluation: Evaluation is the practical implementation of the clues and information collected, and this step involves screening out what piece of information could be useful and presented in court against the guilty. Presentation: This step involves refining of the data accumulated and presenting it in front of the jury in such a way that it can be understood by the non-technical elements Conclusion: “For murder, though it has no tongue, will speak with the most miraculous organ” . (LYNCH, J. M. (2009). Hamlet secret: )(6) , If this quote is taken into account, it would seem that murder has chosen Forensic Computing to be its most vital organ. Whether it is involved in storing data, matching prints, or providing any other evidence on the digital media, this is one of the most active fields in the solving of criminal cases. It is a language, by means of which the dead communicate with the living, the past with the present. Forensic Computing is one of the most recent, as well as one of the most increasingly effective breakthroughs, in the art of modern day investigations, especially those of computer mediated crimes. It is predominantly due to this field that so many criminals are behind bars, and so many proven innocent. One might even go far enough to say that forensic computing is a life saver. Bibliography: 1- Computer Forensics World. “Computer Forensics Basics: Frequently Asked Questions”. (Online) Retrieved April 3rd, 2009, from ( http://www.computerforensicsworld.com/ ) (2)- VACCA, J. R. (2009). Computer and information security handbook. Amsterdam, Elsevier 3)- Enron scandal : Sterling, T. F. (2002). The Enron scandal. New York: Nova Science Publishers. 4)-ASMA, S. T. (2009) . On monsters: an unnatural history of our worst fears. Oxford, Oxford University Press 5- CASEY, E. (2011). Digital evidence and computer crime: forensic science, computers and the Internet. Waltham, MA, Academic Press. 6- LYNCH, J. M. (2009). Hamlet secret: a self-directed workbook for living a passionate, joy-filled life. [S.l.], Authorhouse. - (2010). The ultimate book of top 10 lists: a mind-boggling collection of fun, fascinating and bizarre facts on movies, music, sports, crime, celebrities, history, trivia and more. Berkeley, Calif, Ulysses Press . -BUNTING, S., & WEI, W. (2006). EnCase computer forensics: the official EnCE : EnCase certified examiner. Study guide. San Francisco, Calif, SYBEX. . VACCA, J. R. (2005). Computer forensics: computer crime scene investigation. Hingham, Mass, Charles River Media. -CASEY, E. (2002). Handbook of computer crime investigation: forensic tools and technology. San Diego, Calif, Academic Press. All State Investigations, Inc. January 2005 (http://www.allstateinvestigation.com/ComputerForensicServices.htm) -Virtue, Emily. “Computer Forensics: Implications for Litigation and Dispute Resolutions.” April 2003. (http://ncf.canberra.edu.au/publications/emilyvirtue1.pdf) Read More