Characteristics of Computer Forensics - Essay Example

Computer Forensics Computer Forensics Even though, computers and internet have helped human to bring revolutionary changes in life styles, it is alsocreating worries because of the misuse. In fact cyber crimes are growing day by day everywhere. The antisocial elements are capable of destroying or breaking the highly secure and strong firewalls in order to steal sensitive information from the computers and internet. In short, the security of computers and internet is highly important in the present day computer dominated world. Computer forensics is relatively a new area developed in the world in order to help the computer users and professionals to increase the security of the functioning of the computer systems in the world. According to US-CERT (2008), “computer forensics is the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (US-CERT, 2008,p.1). Computer forensics is an important tool for managers and network administrators who handle the security related issues of the computer systems. Proper understandings about the legal and technical aspects of computer forensics will help the computer professionals to locate and prosecute the intruders more easily. This paper briefly analyses the characteristics of computer forensics, computer forensics jobs, computer forensics education and the pay scale existing in the computer forensics professions. Characteristics of computer forensics “From a technical standpoint, the main goal of computer forensics is to identify, collect, preserve, and analyze data in a way that preserves the integrity of the evidence collected so it can be used effectively in a legal case” (US-CERT, 2008,p.2). It is difficult to prove the cyber crimes in court because of the difficulties in submitting evidences. The intruders can escape easily from punishments because of lack of evidences collected normally from a computer crime location. Since all the intrusion and hacking processes are being done electronically, rather than physically, it is difficult to prove form which source the intruder entered a particular computer. In the absence of computer forensics, the chances of arresting the computer criminals are very feeble. Computer data or memory can be divided into two categories based on the persistence; Persistent data and volatile data. Persistent data are the ones which is stored in the computer hard disks or external memory sources like compact disks, floppies etc. On the other hand the volatile data is stored in the random access memory (RAM). Data stored in the hard disks, compact disks or any other permanent storage mediums can be retrieved any time. On the other hand, it is difficult to retrieve a data which is temporarily stored in random access memory because of the data deletion once the computer is being switched off. The details about the computer users or the intruders are normally stored in the volatile memory and hence it is difficult to retrieve such data once the computer is switched off. On the other hand, if the computer forensics is implemented in a system, it is easy to trace the information stored temporarily in the RAM even after switching off the computer. Cross-drive analysis, live analysis, analysis of the deleted file etc are the common techniques used in computer forensics. In cross drive analysis, information found on multiple hard drives will be analyzed. Cross-drive analysis can be used for performing anomaly detection whereas live analysis is used to examine the computers from within the operating system using custom forensics or existing system administration tools. Live analysis is useful while dealing with the encrypted files. In some computer systems, the logical hard drive volume may be imaged before the computer is shut down and hence the details about the activities performed in the system can be retrieved later. Recovery of deleted file and the analysis of deleted file are vital in collecting evidences against a cyber criminal. Modern computer forensic software has the ability to recover even the deleted data. Most of the modern advanced operating systems have the ability to reconstruct a deleted file even after months. Computer forensics can enhance the reproduction ability of the operating system in reconstructing the deleted file immensely. The main motto of computer forensic experts is not only to find the criminal but also to find out the evidence and the presentation of the evidence in a manner that leads to legal action of the culprit. The major reasons for criminal activity in computers are: Unauthorized use of computers mainly stealing a username and password; Accessing the victims computer via the internet; Releasing a malicious computer program that is virus; Harassment and stalking in cyberspace; E-mail Fraud; Theft of company documents etc (What is computer forensics, 2006). Since computer forensics is a relatively new field, the demand for computer forensic professionals is immense. Even though professional or specialized qualifications are necessary for a computer forensic expert, good salary and other benefits are offered by the big companies to such professionals. Computer forensics jobs, education and the pay scale As per the statistics available for US, for the year of 2010, a computer forensic professional will get a total annual pay in the range of $ 47446- 78487 including bonus (Salary Snapshot for Forensic Computer Analyst Jobs, 2010). Computer forensic professionals have huge demands in Law enforcement agencies, Information technology services, Accounting and auditing firms, governmental agencies, financial services etc. The availability of computer forensic professionals is according to the 2010 statistics is given below Years of Experience Less than 1 year 17% 1-4 years 49% 5-9 years 18% 10-19 years 15% 20 years or more 2% (Salary Snapshot for Forensic Computer Analyst Jobs, 2010) From the above illustrations and statistics it is clear that highly experience professionals are very less in computer forensic profession. Most of the professionals available now have below 4 years of experience. Moreover, the number of females working in the computer forensic profession are very less compared to the number of male professionals working in this field. As per the statistics available for US, for the year of 2010 only 14% of the total professionals available in the computer forensic profession are females whereas the males constitute 86% (Salary Snapshot for Forensic Computer Analyst Jobs, 2010). To start a computer forensics career, youll likely need a computer forensics degree or a related degree (e.g., computer science, criminal justice or engineering) with computer forensics training tacked on, such as through degree major and minor options or post-degree certification. Practical knowledge and skills required depend on the computer forensics career niche youre targeting. But, technical and analytical skills are typically a must for all computer forensics careers. Knowledge and skills in a broad range of computer storage devices, operating systems, programming languages and software applications opens more doors. So does knowledge and skills in some to all of the following specifics (Niznik, 2010) Online courses and regular courses are conducted by many of the universities in order to train professionals on computer forensics. Some of the major universities offering computer forensic courses are California State University, Fullerton (Computer Forensics Certificate), Champlain College, Burlington, Vermont (Computer and Digital Forensics AS and BS Degrees), Missouri Southern State University, Joplin (BS in Computer Information Science and Criminal Justice Administration, computer forensics training option), ITT Technical Institute, School of Criminal Justice (Criminal Justice BS Degree with computer forensics training), Tompkins Courtland Community College, Dryden, New York (Computer Forensics A.A.S. Degree) etc (Niznik, 2010) In short, computer forensics is relatively a new profession which has many scopes in the future. Attractive salaries can be expected in this profession because of the increasing number of cyber crimes and the decreasing number of qualified professionals in the computer forensic profession. References 1. Niznik,J.S. (2010). Computer forensic careers. Retrieved from http://jobsearchtech.about.com/od/computerjob13/a/comp_forensics_2.htm 2. Salary Snapshot for Forensic Computer Analyst Jobs, (2010). Retrieved from http://www.payscale.com/research/US/Job=Forensic_Computer_Analyst/Salary 3. US-CERT (2008). Computer Forensics. Retrieved from www.us-cert.gov/reading_room/forensics.pdf 4. What is computer forensics, (2006). Retrieved from http://www.computerforensics1.com/ Read More