Data Protection with Computer Forensics
A Backup Article Contributed by Sumedh Shanbhag
Computer Forensics and Data Protection
Protection of the strategic value of a company's business always involves the use of computer forensic analysis, as that is where a bulk of the data of the company is stored. Minor errors may result in the loss of millions. Frauds can be performed in a number of ways. Maligning of a person's personal information may cost the person his job and career. Divulging a company's secrets could lead to loss of strategic moves planned by the company.
Libel on the net about a company could damage its reputation beyond repair. The employees may be using extra time from office to surf pornographic sites or play games and may also use the company's resources to meet their own ends. Computer forensics are used to keep a tab on such activities.
Computer forensic examines computer hardware and software through legal procedures, which help prove or disprove allegations and exposes frauds. Such examinations require people who are experienced, stick to the rules of such examination and are knowledgeable enough to deal with law enforcement agencies. Computer forensics should be pressed into action when the reputation or even the existence of a company is at threat. An organization with inadequate security may fall prey to devious and unscrupulous methods.
A victimized organization can only reduce the damage and prevent future occurrences, only if the law enforcement agencies are involved. Some companies use computer forensics to regularly screen the computers of the employees. Thus the employees are less likely to stray when they know they are being watched. However, if the cost of forensic analysis is far greater than the gains from it, the organization may consider it pointless to go through the entire procedure.
Little niggles like over-surfing, do not require computer forensics to solve them. Also, if the roles played by networks and computers are small, then it may not require computer forensic investigation. However, this is very difficult to detect and often it is not easy to determine the role played by computers, until a computer forensic investigation takes place.
Gathering Legal Evidence Through Computer Forensics
The Federal Rules of Evidence determine the rules to be followed during a computer forensic investigation. The analyst has to find, preserve and prepare evidence. Finding evidence is the most tedious part of computer forensic analysis. An analyst may have to go through a number of files to arrive at the correct one which can be used as evidence. It is just like searching for a needle in a haystack.
Preparation of evidence is very important for the evidence to be accepted in court without hassles. The court will not accept evidence which has not been properly documented. As such details such as origin of evidence, form of derivation and proof of the evidence not being rigged should be systematically documented.
Preservation plays a crucial role in computer forensic analysis. Computer forensic analysis is like searching for a needle in a haystack. Therein lies the importance of preserving such evidence. The managers and system administrators of a company where the computer forensic analysis is being performed must be forewarned from handling the specimen computer. Many a times, the system administrator, in the process of helping the computer forensic analyst, may destroy valuable evidence.
Examiners must photograph evidence, take the requisite backups, handle transportation with care and take other such precautions while performing his duty. Investigators must always assume the worst and start working from that point of view.
Growing Importance of Computer Forensics
The growth of the use of computers and networks has led to an increase in the crime rate committed through computers. The importance of computer forensics has also increased accordingly, as computers today lie at the heart of every business and commercial activity. However, the investigations are so specialized that it is not advisable for a company to maintain a personal computer forensic analyst. Instead, the company should avail the services of specialized computer forensic organizations to do the job whenever necessary.
