Computer Forensics Explained

A Backup Article Contributed by Melissa Larose

Computer Forensics Explained

Computer forensics involves the scientific process of examining and analyzing data held or stored on computer media that may be used as evidence in a court. Origin, content, point of entry, time frame, all of these things can be established through computer forensics.

Computer Forensics Takes Accuracy

Every one of us has dealt with the rush-rush attitude of society. We are pushed to complete projects in unrealistic time frames. Our days are filled with running to and fro in our vehicles, picking up this child, dropping off that child, and completing simple chores that are the underpinnings of our lives. And frankly not having enough time to breathe. Computer forensics, or any type of forensics, cannot be rushed.

Forensics specialists should never be forced to speed things up. Their job is to be accurate and accuracy takes time. The integrity and security of their evidence is what is most important. Shortcuts are not part of their creed nor should they be. This is an accepted part of forensics practitioners that accuracy out weighs the need for speed and pressure is not even considered.

Why Computer Forensics is Needed

The need for computer forensics and its service companies springs from the social acceptance of the personal computer. The personal computer is everywhere, home, school, business, church, and government. Crime specialists need access to those computers and the processes they follow need to be those acceptable in a court of law.

There appear to be four types of problems that computer forensics specialist are faced with - preserving the integrity of the evidence during recovery, the security and storage of the evidence after it has been located, finding the correct information in large volumes of data and logs, and finally, how to present the evidence in court and as disclosure to the defense. Anywhere along this line data integrity can be compromised, lost, or stolen. The same can be said of paper evidence as well.

The traditional response to computer evidence is to ignore it. But this doesn't make much sense when the actual crime is committed using a computer. It seems this would prevent a crime from investigation. But the alternative may not be much better at this point in time.

Locating a Well Trained Computer Forensics Team

IT seems there are not many well-trained computer forensics teams available these days. That has many people searching for the right way to assemble a trained team. The risk in not using a well-trained team means that potentially successful cases may fail due to poor presentation, inaccurate procedures or use of the wrong equipment in gathering and storing the evidence.

Recruitment is difficult because there is such a lack of personnel that exists. Once these individuals are found the cost of paying them may be prohibitive. These people are in high demand, easily convinced to take other positions, not always available when needed, and easily bored by the repetitive portion of the process. In addition, these individuals must possess skills in forensics and the technical side of technology.