Introduction to Computer Forensics

Computer Forensics Definition

• Computer forensics involves obtaining and analyzing digital information as evidence in legal cases, including civil, criminal, or administrative proceedings.

Computer Forensics vs. Other Disciplines

• Computer forensics investigates digital data retrieved from computer hard drives or other storage media.
• Network forensics focuses on how attackers or perpetrators gain access to a network.
• Data recovery aims to retrieve accidentally deleted information or data lost during power surges or server crashes.
• Computer forensics specifically focuses on recovering hidden or deleted data for use as evidence.
• This evidence can be inculpatory (incriminating) or exculpatory (exonerating).
• Disaster recovery employs computer forensics techniques to retrieve lost information.
• Investigators often work collaboratively to secure computers and networks within an organization.

Public and Private Investigations

• Computer investigations and forensics fall into two categories: public and private/corporate investigations.

Preparing for Computer Investigations

• Public investigations involve government agencies responsible for criminal investigations and prosecutions.
• These organizations must adhere to legal guidelines, specifically the law of search and seizure, which protects the rights of everyone, including suspects.

Law Enforcement Agency Investigations

• Criminal cases involve trying a suspect for a criminal offense, such as burglary, murder, or molestation.
• While computers and networks might serve as tools to commit crimes, specific computer crime laws address offenses like data theft.
• Legal processes vary based on local customs, legislative standards, and rules of evidence.
• Criminal cases typically involve three stages: the complaint, the investigation, and the prosecution.
• A police officer documents the initial complaint and collects evidence to support the allegation.
• Investigators then process and analyze the collected information.

Corporate Investigations

• Private or corporate investigations involve private companies and lawyers dealing with company policy violations and litigation disputes.
• Corporate computer crimes range from e-mail harassment and data falsification to gender and age discrimination, embezzlement, sabotage, and industrial espionage.
• Establishing company policies helps avoid litigation by providing clear guidelines for employees.
• Well-defined policies empower computer investigators and forensic examiners to conduct internal investigations.
• Displaying warning banners, typically when a computer starts or connects to the corporate network, informs users that the organization reserves the right to inspect systems and network traffic.
• This helps establish the organization's right to conduct investigations and removes any expectation of privacy.
• Designating an authorized requester, often defined by executive management, grants individuals the authority to initiate investigations.
• This authority should be vested in groups like Corporate Security Investigations, the Corporate Ethics Office, Corporate Equal Employment Opportunity Office, Internal Auditing, the general counsel, or the Legal Department.
• Security investigations commonly address issues like abuse or misuse of corporate assets, e-mail abuse, and internet abuse.
• Corporations often follow the silver-platter doctrine, which describes the process when a civilian or corporate investigator delivers evidence to a law enforcement officer.
• It's crucial to distinguish between personal and company property, especially with devices like PDAs, cell phones, and personal notebooks.
• To avoid potential issues, companies often restrict the use of personally owned devices on company-owned resources to prevent data mixing.

Maintaining Professional Conduct

• Professional conduct is essential for maintaining credibility and includes ethical behavior, morals, and high standards.
• Maintaining objectivity involves forming and upholding unbiased opinions regarding cases.
• Confidentiality is crucial to preserving an investigation's credibility, especially in corporate settings.
• Rare instances may arise where a corporate case progresses to a criminal case, potentially involving serious offenses like murder.