IA - DIGITAL FORENSICS Flashcards
Branches of Digital Forensics
- Computer Forensics
- Mobile Device Forensics
- Network Forensics
is a branch of digital forensics concerned with evidence found in computers and digital storage media
Computer Forensics
focused on the recovery of digital evidence form mobile devices using forensically sound methods
mobile device forensics
involved the alleged breaking of laws and law enforcement agencies and their digital forensic examiners
criminal cases
examiners specialize in one area of digital evidence; either at broad level or sub-specialisst
Digital Evidence Examiners
focused on monitoring and analyzing computer network traffic for information gathering, legal evidence or intrusion detention
network forensics
- gather or process evidence at crime scenes
- trained on the correct handling of technology
Digital Forensic Technician
Purpose of digital forensics
- criminal cases
- civil cases
- someone who has a desire to follow the evidence and solve a crime virtually
- recover data like documents, photos, and emails from a computer hard drive and other storage devices such as zip and flash drives with deleted, damaged, or otherwise manipulated
Digital Forensics Investigator
involved the protection of rights and property of individuals or contractual disputes between commercial entities where a form of digital forensics called electronic discovery may be involved
civil cases
- the admissibility of digital evidence relies on the tool used to extract it
- Forensic tools are subjected to the Daubert standard, where judge is responsible for ensuring that the processes and software used were acceptable
Investigative tools
Example Uses of Digital Forensics
- Intellectual Property Theft
- Industrial Espionage
- Employment Disputes
- Fraud Investigations
- Forgeries Related Matters
- Bankruptcy Investigations
- Inappropriate Use of The Internet and Email in workplace
- Issues Concern with the regulatory compliance
GENERAL TOOLS USED IN FOLLOWING CATEGORIES
- disk and data capture tools
- file viewer tools
- file analysis tools
- internet analysis tools
- email analysis tools
- registry analysis tools
- mobile device analysis tools
- mac os analysis tools
- network forensics tools
- database forensics tools
Internet crime is for investigators, laboratory and technical personnel to understand and how the process works and to stay closely engaged with advances in software and tracking techologies
Internet-Based
crims such as pornography, copyright infringement, extortion or counterfeiting have digital evidence which is on the computer’s hard drive and general equipment, including removable devices such as thumb drive and CRDOM
Stand-Alone Computers or Devices
- allow criminals to engage in an ever-growing variety of activities and devices keep track of every move and message
- it is th tracking capability that truns mobile devices into key evidence in many cases
Mobile Devices
Stages of Digital Forensics Investigation
- identification
- preservation
- analysis
- documentation
- presentation
is any probative information stored or transmitted in digital form that a party to a court case may use in trial
digital evidence
physical evidence cannot be wrong. it cannot perjure itself, it cannot be wholly absent. only human failure to find it, study and understand it, can diminish its value
Locard’s Principle
- deter any alteration in evidence, either intentionally or unintentionally, states that the court prefers original evidence in trial rather than a copy
- are used to establish a credible link between the attacker, victime, and crime scene
Best Evidence Rule
types of investigation
- criminal forensics
- intelligence gathering
- electronic discovery
- intrusion investigation
is usually part of a wider investigation conducted by law enforcement and other specialists with reports being intended to facilitate that investigation and ultimately be entered as an expert evidence before court
criminal forensics
is often associated with crime providing intelligence to help track, stop, or identify criminal activity
intelligence gathering
has a specific legal limitations and restrictions, usually in relation to the scope of any investigation
electronic discovery
