Computer Forensic Recovery

Forensic computer investigations seek to gather evidence for determining whether computer systems have been used for unlawful or unauthorized activities. The evidence can reside in computers, storage devices and the network.

The investigations have to be conducted in a forensically sound manner acceptable to a court of law. Essentially this means that the evidence must be gathered in a manner that cannot be challenged in a court of law on grounds of tampering, inaccuracy, etc.

Forensic computer investigators require an awareness of legal issues involved as well as technical skill and familiarity with computer systems.

Collecting Evidence From Computer Systems

Taking digital photographs of the room, computers and surroundings is a typical starting point. This is done when the system is seized and before anything is changed.

A forensic computer investigator should be aware that the suspect who committed the unlawful activities could be an expert. This means that the person is quite likely to have installed anti-detection measures such as wiping out evidence whenever certain actions of an investigative nature are initiated.

Hence, the investigator should proceed in a manner that simulates an ordinary user when handling the computer.

When working with live systems, much of the data is in a highly perishable form. For example, the contents of RAM, which can include passwords, encryption keys and system/program settings, can disappear if the computer is powered off.

The investigator has to proceed in a manner that the more perishable data are collected first. The typical order will be:

• Network connection that can reveal the points with which a computer had been connected to and what data was being transferred
  
• RAM that can provide details of programs that were currently running or were recently run
  
• System settings that can identify all users, currently logged in users, system date and time, currently accessed files and current security policies
  
• Hard disks that can contain much of the data needed for the investigation must be imaged in such a way as to not affect the original drives data or impair any investigation using the image.
  

The forensic investigator then proceeds to collect all removable computer storage media such as CD/DVD, USB memory cards, music players, digital camera cards and so on. In addition to computer hardware and media, the investigator will collect printouts, notes and other physical evidence lying around.

Notes can contain user id password combos and security related instructions that make the task of investigation much easier. An even more valuable source is the user of the system, who can reveal passwords, encryption methods and other information that can help the investigation immeasurably.

Forensically Sound Computer Investigation

Courts scrutinize all evidence produced before them for acceptability. Defense lawyers can challenge the evidence by pointing to any actions or circumstances that make the evidence unreliable. It is thus highly important that all evidence be collected in a manner that leaves no room for such challenges.

The investigator has to document every action the person has taken. The evidence must be kept under safe custody in a manner that only authorized team members can access them. Analysis of storage media is done with copies and not with the originals, because the analytical procedures can change the contents.

The tools used must have been tested and evaluated to validate their accuracy and reliability. Exact duplicates of all storage media are made using such validated tools and it is these copies that are worked with.

The above are just some of the major concerns that illustrate how a forensic computer investigation proceeds. Only a trained investigator is likely to secure forensic evidence that can satisfy a court of law.

Conclusion

Forensic computer investigations seek to help determine whether unlawful or unauthorized activities have been committed using computer systems. The investigator collects data residing in network connections, computer memories, the computer hardware, hard disks and removable storage media.

The investigation is done using validated tools and in a manner that would be acceptable to a court of law. A forensic computer investigator requires legal awareness as well as technical skill to collect and analyze the gathered evidence.

In this high paced, high tech world one of the things that we can depend on is that the crooks are usually one step ahead of the cops. This doesn’t mean that the cops are less clever than the crooks; it just means that there are fewer of them, with fewer resources and with loads more red tape. One area that criminals have taken serious advantage of is computer driven crime. A little technical know-how, a little computer savvy and it seems that just about anyone is an insider trader waiting in the wings.

We’ve all seen on TV how police forces and agencies have caught on and how they all have computer specialists who can crack computer codes, catch hackers and piece together broken computers and retrieve data from the tiny bits. Mostly we get this from CSI. Realty is probably a little different. In cases where computers are involved, experts from outside companies are usually called in to offer their services. They may be called in to secure proof or to repair or protect altered or damaged data. Their job is extremely important and may have a direct bearing on the outcome of a case; it depends on the reliability of the data retrieved, which often depends on the skill of the technician as well as on the original level of data corruption.

Computers used in unlawful activities often hold all the proof needed to convict suspects, even if they have deleted the evidence, formatted the computer or deliberately tried to damage it. Proof gained from computers has been used successfully in trade cases, secret theft, industrial espionage, divorce, and fraud, discrimination, narcotics, and smuggling and corruption cases. Experts are able to examine the computers and see whether or not data has been erased or damaged. They are then able to look for specific data, phrases, file, numbers and keywords. Once the data has been accessed they are able to determine if it has been used unlawfully used and can authenticate any breach of the software license.

This is all very interesting and I am sure we all very pleased that criminals who think that they are so smart, aren’t and get their comeuppance and all. Even though it is a somewhat scary thought knowing that you can’t completely hide everything that you do and that someone might always be able to find out. Its very George Orwell – 1984 -ish. In other words, not very comforting.

An important question, however remains: What happens if, just for arguments sake and this is rather extreme but run with it, what would happen if a movie scenario did come true? Lets use a James Bond scenario, anyone, they all use computers, just about. What if the world found itself held to ransom by a lunatic with very powerful computers and the ability and will to use them to create havoc and do much damage to most of the developed world? What would our forensic experts be able to do then? Would they be able to do anything? Would we have to turn to all the hackers that our forensic experts have put in jail, as so often happens in the movies? Are we ready for an uber criminal? Is one brewing? Have I once again been watching too many action movies?

Think what Al Capone could have done with the technology of computers. He would probably still have been caught for tax evasion but the scale could have been so much grander. He could have had his finger in about 3 dozen more pies than he did at the time. The man could have been epic. He could have been almost mythic in stature. He’s the kind of man who would have held the world to ransom. He’s the kind of man who would probably have got away with it. Elliot Ness would have needed a bigger gang of untouchables. They would have had to keep Sean Connery alive throughout the movie; goodness knows he was the brains behind the whole operation.

While more and more people are turning to computers to commit crime, experts are coming up with more and more refined ways of catching them. Not even damaging the computer or the hard drive is enough to destroy evidence; experts can piece together data from deliberately damaged computers just as easily as they can from accidentally deleted files. The point here is forensic computer services is a growing and evolving field, think twice before you decide that no one will miss that 20 grand.

Forensic Science is the application of science in forensic studies, the forensic part of forensic science implies that it is to be utilized in some form or another with a court of law and is relevant to legal proceedings. Forensic Science is rapidly progressing to the point that the science fiction of today could well be the science reality of tomorrow.

Forensic Science has been around for many centuries. However, it was not until recently that advances in scientific research and scientific studies made this a true and individual aspect of forensic research. Recent studies and research have brought the field of forensic science to new heights and given it increasing credibility and importance as a deciding factor in many legal proceedings, where forensic evidence often outweighs the testimony even of witnesses on the scene.

Almost everybody has heard of DNA evidence or fluorescing as well as many other recent scientific developments in forensic science. While many of us get our information from television programs such as CSI, the reality is that forensic science is rapidly moving from the realm of television to the broader expanse of the real world. DNA evidence is now an important part of most legal proceedings involving any human body. Whether discussing fibers from hair, clothes or even something so mundane as dust, forensic science can often draw conclusions and point to irrefutable facts that often lead to convictions of criminals who, if not for forensic science, would be free to commit more atrocities.

Fibers can have a telling tale that can only be exposed by the use of forensic science. Carpet fibers are unique to makes and manufacturers. Gunpowder contains microscopic residue that can correctly identify the type of powder, the manufacturer of the shell and much more information. Simple particles of dust, when viewed by using forensic science can place items or individuals at definitive places often down to an exact time frame. Something that we may see as just a bug or insect can tell how long an item has been in a particular location. There are many factors that are explored with Forensic Science. The scientific conclusion offers irrefutable proof and can be an effective tool in the fight against crime.

Advances in science and in particular with forensic science are not only new and fascinating but are constantly improving and being refined. Not only is forensic science a great tool for today, but the future looks bright indeed. An interest in Forensic science may even help the underachiever of today take enough interest in science and related fields of study to turn around and study harder to become the next practitioner of forensic science tomorrow. Forensic science benefits society as a whole in many different ways.

Forensic computer investigations seek to gather evidence for determining whether computer systems have been used for unlawful or unauthorized activities. The evidence can reside in computers, storage devices and the network.

The investigations have to be conducted in a forensically sound manner acceptable to a court of law. Essentially this means that the evidence must be gathered in a manner that cannot be challenged in a court of law on grounds of tampering, inaccuracy, etc.

Forensic computer investigators require an awareness of legal issues involved as well as technical skill and familiarity with computer systems.

Collecting Evidence From Computer Systems

Taking digital photographs of the room, computers and surroundings is a typical starting point. This is done when the system is seized and before anything is changed.

A forensic computer investigator should be aware that the suspect who committed the unlawful activities could be an expert. This means that the person is quite likely to have installed anti-detection measures such as wiping out evidence whenever certain actions of an investigative nature are initiated.

Hence, the investigator should proceed in a manner that simulates an ordinary user when handling the computer.

When working with live systems, much of the data is in a highly perishable form. For example, the contents of RAM, which can include passwords, encryption keys and system/program settings, can disappear if the computer is powered off.

The investigator has to proceed in a manner that the more perishable data are collected first. The typical order will be:

• Network connection that can reveal the points with which a computer had been connected to and what data was being transferred
  
• RAM that can provide details of programs that were currently running or were recently run
  
• System settings that can identify all users, currently logged in users, system date and time, currently accessed files and current security policies
  
• Hard disks that can contain much of the data needed for the investigation must be imaged in such a way as to not affect the original drives data or impair any investigation using the image.
  

The forensic investigator then proceeds to collect all removable computer storage media such as CD/DVD, USB memory cards, music players, digital camera cards and so on. In addition to computer hardware and media, the investigator will collect printouts, notes and other physical evidence lying around.

Notes can contain user id password combos and security related instructions that make the task of investigation much easier. An even more valuable source is the user of the system, who can reveal passwords, encryption methods and other information that can help the investigation immeasurably.

Forensically Sound Computer Investigation

Courts scrutinize all evidence produced before them for acceptability. Defense lawyers can challenge the evidence by pointing to any actions or circumstances that make the evidence unreliable. It is thus highly important that all evidence be collected in a manner that leaves no room for such challenges.

The investigator has to document every action the person has taken. The evidence must be kept under safe custody in a manner that only authorized team members can access them. Analysis of storage media is done with copies and not with the originals, because the analytical procedures can change the contents.

The tools used must have been tested and evaluated to validate their accuracy and reliability. Exact duplicates of all storage media are made using such validated tools and it is these copies that are worked with.

The above are just some of the major concerns that illustrate how a forensic computer investigation proceeds. Only a trained investigator is likely to secure forensic evidence that can satisfy a court of law.

Conclusion

Forensic computer investigations seek to help determine whether unlawful or unauthorized activities have been committed using computer systems. The investigator collects data residing in network connections, computer memories, the computer hardware, hard disks and removable storage media.

The investigation is done using validated tools and in a manner that would be acceptable to a court of law. A forensic computer investigator requires legal awareness as well as technical skill to collect and analyze the gathered evidence.

In previous articles we explored some of the most commonly known areas in which forensic experts carry out their daily duties. Among these, we mentioned forensic anthropology, forensic pathology, forensic dentistry, forensic nursing and forensic chemistry or toxicology. Forensic Science, however, is a very broad field of study and involve many other disciplines that on a daily basis contribute to solve crimes. Let us now take a brief survey of other, less known aspects of Forensic Science.

Forensic Entomology: Even though mostly disregarded (at best), insects can result highly informative and even critical for certain forensic investigations. Many insects develop through a complex series of stages from egg to adult, but most important is that these life cycles are highly consistent, the different stages occur always in the same way and take the same time to complete. Knowing this, an entomologist (someone who is expert in insect biology) can make a number of useful observations and establish conclusions based on the insect larvae and adults that are present in a corpse. Insect evidence can provide estimations of the time passed since death. It is also possible to determine how long a body has been dead or whether or not a body has been moved after death.

Forensic Botany: Plants or certain vegetal matter can often be very informative about the decaying process of human bodies and their surroundings. Botanists can analyze seeds, pods, roots, leaves, stems, and more to determine when and where a body died, if a body was moved after death. Under certain conditions they can also establish estimates of time since death and location of death estimations based on plant evidence.

Forensic Photography: Although it has changed a lot since the golden age of police TV serials and movies, photography is still a crucial component of forensic work. A forensic photographer must carry out meticulous and comprehensive visual documentation of death scenes, crime scenes and accident scenes. This include the general scenario but also many details that are often disregarded at first glance but can result very important at later stages of the investigation. The intuition of the photographer is very important in this case. Forensic photography makes use of special equipment and techniques such as macrophotography when it is necessary to record images of small evidentiary materials such as bullets or other projectiles, blood spatter, or any sort of close-ups of evidence at death scenes. These professional exhibit profound knowledge and skill in general photography, film developing, digital photography, videography, digital imaging and other, more focused techniques.

Homicide Detective, Crime Scene Investigator. This is a less defined but important part of the forensic work. These workers are usually in charge of organizing the investigation of death scenes and performing collection of evidence associated with death(s). They also conduct or supervise further stages such as processing of evidence and all the administrative work associated with investigating deaths and crimes. In some institutions or departments, these positions are occupied by sworn officers that have received the appropriate training to supervise the scientific aspects of resolving a criminal case and can be under the jurisdiction of a senior officer or an attorney.

Output data RECOVERY: Dispelling the myths of Data Recovery

A lot of myths surround the concept of computer code recovery. You hear people having it out with their PC's when they inadvertently deleted remarkable files from their hard drives. Or you see someone post in information recovery forums asking how they should go about reloading information that was irrevocable when their digital computer crashed. So-called output data recovery high-level advisers would reply, "You made back-ups, didn't you?" And of course, you didn't, so there goes your final history project down the drain.

The theory is: What's gone is gone.

All the same in practically cases of computer code recovery, that is not always the case. As lengthy it was not overwritten physically, input data once saved into the system is never completely gone. Whether it was inadvertently deleted, corrupted by a virus, or the disk was formatted, or partitioned then deleted, computer code will stick to the system like gum to a shoe. This is the small fact that the whole concept of computer code recovery is based on.

What really occurs with data waste is that the files are regularly unavailable by usual measures. For instance, your file about, how to make a recovery partition was deleted. This doesn't mean you're going to have to do the research all over just to pass that final exam your psycho IT professor will give you on Friday. The file is in any event in the drive only as a signature byte which has been added to the beginning of its file name.

Now, here's the tricky part. The file will always reside in the drive however once you save some new information, the new computer code will take the space occupied by the signature file. So if you lose any files, be sure that you don't put in any more input data so you can keep that deleted file intact, and therefore, available for computer code recovery.

So with output data recovery, you just have to remember one thing: Never enter new computer code right after you inadvertently dispose of a file.

Lesson learned? Now, we move on to the next important myth to eliminate.

Installing this one information recovery software won't hurt, will it?

The answer is definite: NO. Yet data recovery software is the in-thing right now and allowing it to install on your drive might seem like a plausible solution, DON'T install it into your drive. You can nevertheless apply your downloaded version of data recovery software but you will need to run it on a separate, healthy hard drive.

Remember Lesson #1: Never enter new computer code into your drive. A easily understood 1 MB of input data recovery software can diminish the chances of data recovery success in reloading input data into an uncorrupt drive.

Data recovery professionals are advisors in recovering and reloading computer code.

But even high-level advisers scratch their heads at times in the bring before of a really physically busted drive where not even the remotest possibility of computer code recovery is reasonable. And they can't completely restore data 100%. They're authorities, not gods.

So what is the best way to conquer data weathering? Answer: Always have back-up files. And one of the best way is to make a backup recovery partition.