Main Issues Language and terminology

Question 1

What is forensics

Answer 1

The use of science to process collected evidence so one can:

1. Establish “the facts of a case”
2. Examine in a consistent and scientific manner
3. Make sure that there is no alteration of the facts
4. make sure the analysis and conclusions does correspond to the reality/truth

Question 2

Forensics primarily deals with latent evidence, what is latent evidence?

Answer 2

It may take many forms that range from fingerprints to DNA to the files of a hard drive.

Question 3

Why do we need digital forensics?

Answer 3

We live in a high technology society and the growth of cyberspace is exponential, almost everything is connected to the internet. Cyber crimes becomes overwhelming and there is a constant need for improvement of the security of the whole societal infrastructure.

Question 4

What is Computer forensics?

Answer 4

It´s the use of investigative and analytical techniques to..
1. Identify
2. Collect
3. Examine
4. Preserve
..information that is digitally stored and encoded

Question 5

What is Digital Forensics?

Answer 5

The process of uncovering and interpreting electronic data. The goal is to preserve any evidence in its most original form while performing a structured investigation by..
1. collecting
2. identifying
3. validating
.. the digital information for the purpose of reconstructing past events.

Question 6

Name some challenges in digital forensics

Answer 6

• Data deluge (3V -Volume,Veracity, Velocity)
• Distributed crime scene activities and artifacts
• Limitations of resources
• Exponential growth of caseloads

Question 7

Explain the difference between forensics and security

Answer 7

Security - In general security wants to preserve the digital system as it is, observing the policy that has been defined, a lot of risk assessment.
Forensics - Attempts to explain how the policy came to be violated which may lead to finding flaws and hence making improvements in the future

Question 8

What is auditing?

Answer 8

A snapshot of the current state of the system, we need to be able to backtrack. Trails, usually machine readable that have to be made human readable

Question 9

What is evidence?

Answer 9

In the broadest sense includes everything that is used to determine or demonstrate the truth of assertions.

Question 10

Which are the 5 TYPES of evidence?

Answer 10

• Intuitive
• Scientific
• Personal
• Anecdotal
• Legal

Question 11

Which are the 4 CATEGORIES of evidence?

Answer 11

• Impressions
• Bioforensics
• Trace evidence
• Material evidence

Question 12

Which are the 7 +1 CLASSIFICATIONS of evidence?

Answer 12

• Circumstantial
• Direct
• Documentary
• Original
• Real
• Hearsay
• Testimony

+Expert Testimony

Question 13

Give examples of impressions evidence

Answer 13

• fingerprints
• tool marks
• footwear marks

Question 14

Give examples of bioforensic evidence

Answer 14

• body fluids
• hair
• nail scrapings
• blood stain patterns

Question 15

Give examples of trace evidence

Answer 15

(residue of the things used for committing the crime)

• arson accelerant
• paint
• glass
• fibers

Question 16

Give examples of material evidence

Answer 16

• letters
• folders
• scrapped paper

Question 17

Define circumstantial evidence

Answer 17

not an evidence of the fact in the issue, however it´s an evidence which can be used to infer information about the existence or non-existence of a fact in the issue

Question 18

Define direct evidence

Answer 18

may refer to first-hand evidence

Question 19

Define documentary evidence

Answer 19

refers to the evidence provided by the contents of documents including any description recorded on them

Question 20

Define original evidence

Answer 20

depends on the context but can refer to first-hand evidence, not the result of a derivative process, like a original hand written letter. In verbal words uttered by someone else other than testifying witness

Question 21

Define real evidence

Answer 21

physical evidence

Question 22

Define hearsay

Answer 22

made outside of the court, but produced as an evidence in a court

Question 23

Define testimony

Answer 23

traditionally a sworn of a witness in a court

Question 24

Define expert testimony

Answer 24

A testified opinion of a person with knowledge, expertise, training or education. Provided that the testimony is based on:

1. Sufficient facts and data
2. Reliable principles and methods
3. Reliable application of (2)