New Technology Reviews!.: Forensics

Computer Forensics Expert - An Ideal Career Option

If you are a fresh graduate from information and communications technology who haven't decided on your area of specialty, there is a unique career option for you. You may want to consider computer forensics as a career. This profession is a fast growing career which has high demands in the job market due to the increasing number of cyber crime activities that are taking place throughout the world. Let's analyze whether this profession is an ideal career that is able to promise a bright future. In the current job market, there are not many experts in this field yet as this subject is still new to a lot of people. However, demand for such experts is increasing in United States and Europe where many companies are facing real-time cyber crime activities. According to recent statistics, around 85% of businesses and government agencies worldwide are experiencing increased internet crimes, ranging from hacking, web page defacement, information theft, industrial espionage, intellectual property loss and so on. Looking at the trend in the employment market, computer forensics expert is considered as a very niche occupation and its employability is definitely high. Moreover, the average annual income for this profession can be up to USD 200,000. It is indeed a profession with very good prospect. In terms of the nature of the job, it is really challenging and exciting. You need to deal with many people, cases and fraudulent activities related to computers from time to time. Your main tasks are to investigate cyber criminals, safeguard the digital evidence and find out illegal activities for the good sake of the companies, society as well as the country. Getting involved in this field would definitely provide you great self satisfaction. This profession can definitely become your life long career. A promising career pathway is identified and created for you in the long run. Since this profession is internationally recognized, you are able to contribute in whichever country you are. To sum it, computer forensic expert is indeed an ideal career that can lead you to great success in the future.

Computer Forensics Expert - An Ideal Career Option

If you are a fresh graduate from information and communications technology who haven't decided on your area of specialty, there is a uni...

Best Practices for Computer Forensics in the Field

IntroductionComputer forensic examiners are responsible for technical acuity, knowledge of the law, and objectivity in the course of investigations. Success is principled upon verifiable and repeatable reported results that represent direct evidence of suspected wrong-doing or potential exoneration. This article establishes a series of best practices for the computer forensics practitioner, representing the best evidence for defensible solutions in the field. Best practices themselves are intended to capture those processes that have repeatedly shown to be successful in their use. This is not a cookbook. Best practices are meant to be reviewed and applied based on the specific needs of the organization, the case and the case setting.Job KnowledgeAn examiner can only be so informed when they walk into a field setting. In many cases, the client or the client's representative will provide some information about how many systems are in question, their specifications, and their current state. And just as often, they are critically wrong. This is especially true when it comes to hard drive sizes, cracking laptop computers, password hacking and device interfaces. A seizure that brings the equipment back to the lab should always be the first line of defense, providing maximum flexibility. If you must perform onsite, create a comprehensive working list of information to be collected before you hit the field. The list should be comprised of small steps with a checkbox for each step. The examiner should be completely informed of their next step and not have to "think on their feet."OverestimateOverestimate effort by at least a factor of two the amount of time you will require to complete the job. This includes accessing the device, initiating the forensic acquisition with the proper write-blocking strategy, filling out the appropriate paperwork and chain of custody documentation, copying the acquired files to another device and restoring the hardware to its initial state. Keep in mind that you may require shop manuals to direct you in taking apart small devices to access the drive, creating more difficulty in accomplishing the acquisition and hardware restoration. Live by Murphy's Law. Something will always challenge you and take more time than anticipated -- even if you have done it many times.Inventory Equipment Most examiners have enough of a variety of equipment that they can perform forensically sound acquisitions in several ways. Decide ahead of time how you would like to ideally carry out your site acquisition. All of us will see equipment go bad or some other incompatibility become a show-stopper at the most critical time. Consider carrying two write blockers and an extra mass storage drive, wiped and ready. Between jobs, make sure to verify your equipment with a hashing exercise. Double-Check and inventory all of your kit using a checklist before taking off.Flexible AcquisitionInstead of trying to make "best guesses" about the exact size of the client hard drive, use mass storage devices and if space is an issue, an acquisition format that will compress your data. After collecting the data, copy the data to another location. Many examiners limit themselves to traditional acquisitions where the machine is cracked, the drive removed, placed behind a write-blocker and acquired. There are also other methods for acquisition made available by the Linux operating system. Linux, booted from a CD drive, allows the examiner to make a raw copy without compromising the hard drive. Be familiar enough with the process to understand how to collect hash values and other logs. Live Acquisition is also discussed in this document. Leave the imaged drive with the attorney or the client and take the copy back to your lab for analysis.Pull the PlugHeated discussion occurs about what one should do when they encounter a running machine. Two clear choices exist; pulling the plug or performing a clean shutdown (assuming you can log in). Most examiners pull the plug, and this is the best way to avoid allowing any sort of malevolent process from running that may delete and wipe data or some other similar pitfall. It also allows the examiner access to create a snapshot of the swap files and other system information as it was last running. It should be noted that pulling the plug can also damage some of the files running on the system, making them unavailable to examination or user access. Businesses sometimes prefer a clean shutdown and should be given the choice after being explained the impact. It is critical to document how the machine was brought down because it will be absolutely essential knowledge for analysis.Live AcquisitionsAnother option is to perform a live acquisition. Some define "live" as a running machine as it is found, or for this purpose, the machine itself will be running during the acquisition through some means. One method is to boot into a customized Linux environment that includes enough support to grab an image of the hard drive (often among other forensic capabilities), but the kernel is modified to never touch the host computer. Special versions also exist that allow the examiner to leverage the Window's autorun feature to perform Incident Response. These require an advanced knowledge of both Linux and experience with computer forensics. This kind of acquisition is ideal when for time or complexity reasons, disassembling the machine is not a reasonable option.The FundamentalsAn amazingly brazen oversight that examiner's often make is neglecting to boot the device once the hard disk is out of it. Checking the BIOS is absolutely critical to the ability to perform a fully-validated analysis. The time and date reported in the BIOS must be reported, especially when time zones are an issue. A rich variety of other information is available depending on what manufacturer wrote the BIOS software. Remember that drive manufacturers may also hide certain areas of the disk (Hardware Protected Areas) and your acquisition tool must be able to make a full bitstream copy that takes that into account. Another key for the examiner to understand is how the hashing mechanism works: Some hash algorithms may be preferable to others not necessarily for their technological soundness, but for how they may be perceived in a courtroom situation.Store SecurelyAcquired images should be stored in a protected, non-static environment. Examiners should have access to a locked safe in a locked office. Drives should be stored in antistatic bags and protected by the use of non-static packing materials or the original shipping material. Each drive should be tagged with the client name, attorney's office and evidence number. Some examiners copy drive labels on the copy machine, if they have access to one during the acquisition and this should be stored with the case paperwork. At the end of the day, each drive should link up with a chain of custody document, a job, and an evidence number.Establish a PolicyMany clients and attorneys will push for an immediate acquisition of the computer and then sit on the evidence for months. Make clear with the attorney how long you are willing to maintain the evidence at your lab and charge a storage fee for critical or largescale jobs. You may be storing critical evidence to a crime or civil action and while from a marketing perspective it may seem like a good idea to keep a copy of the drive, it may be better from the perspective of the case to return all copies to the attorney or client with the appropriate chain of custody documentation.ConclusionComputer examiners have many choices about how they will carry out an onsite acquisition. At the same time, the onsite acquisition is the most volatile environment for the examiner. Tools may fail, time constraints can be severe, observers may add pressure, and suspects may be present. Examiners need to take seriously the maintenance of their tools and development of ongoing knowledge to learn the best techniques for every situation. Utilizing the best practices herein, the examiner should be prepared for almost any situation they may face and have the ability to set reasonable goals and expectations for the effort in question.	 	 		 			 				 					 						Carol L. Stimmel is a Certified Computer Examiner (CCE), co-author of The Manager Pool, and former Vice-President, Consulting of Gartner. She has worked in technology for over 15 years and has been involved in engineering, security, knowledge management, and the establishment of successful entrepreneurial ventures.CITSF provides certified consulting services to the attorney marketplace in the area of computer forensics and e-discovery.Visit CITSF on the web at <a href="http://www.citsf.com" target="_new">http://www.citsf.com</a> She may be reached at 303-819-2068 or carol.stimmel@gmail.com.

Best Practices for Computer Forensics in the Field

Introduction Computer forensic examiners are responsible for technical acuity, knowledge of the law, and objectivity in the course of in...

Computer Forensics Help to Solve All Kinds of Crimes

Computer forensics are used in many fields, from legalities involving trade secrets to prevention of computer-related fraud; however, more and more computer forensics are being used to help solve crimes of all kinds. Computer forensics have both obvious and less obvious implications in a criminal court and are a helpful new tool for prosecutors and police alike.The area of computer data was something that was ignored or under used in court cases for far too long. This was even worse because most criminals are very, very sloppy about their data encryption - they make the game easier for the forensic guys.This type of forensics use scientific methodology to protect, assess, and analyze computer data. Deleted data may be retrieved or recovered, encrypted or password protected data revealed. Damaged computer hardware can also be salvaged in the pursuit of information and answers by the computer forensics team themselves - there's very little information you can safely hide from them. No matter how damaged the digital media is. Computer forensics consciously work within the rules of evidence set out by the criminal courts, thereby providing law enforcement with viable and admissible evidence within a court of law. Basically if they catch you with something they've done it legally and it will stand up in a court of law as evidence.Computer forensics are playing a growing role in the US courts, and electronic forensics experts are called upon in a variety of types of criminal cases. Theft, embezzlement, and fraud may all have computer records and evidence that is assessed and analyzed by a forensics specialist - there's very little done in business today that doesn't involve computers at some level.Even the use of cell phones isn't safe from the forensic guys. Every text message you ever sent, every phone number you ever stored or even any images you ever kept on your cell phone are all items that these guys can undelete and use against you in a court of law. There have been several high profile murder cases examined in the last few years were cell phone forensic evidence played a key role in the prosecution of the criminals. That's right - they were stupid enough to send each other text messages organizing the murder of another human being.Specifically, computer-related crimes, such as hacking, child pornography, and intellectual property theft are also prosecuted with the aid of computer forensics. Furthermore, these forensic teams aid in the search and prosecution of terrorists who may use computer technology for planning, scheduling, and locating acts of terrorism. This has become especially important after 9/11.Computer forensics enable prosecutors and police to gain admissible evidence against offenders, whether the offense is corporate embezzlement or child pornography. A good computer forensics specialist can not only preserve data, but also even reclaim deleted or damaged data and pass this information to the courts.	 	 		 			 				 					 						Are you worried about computer viruses and spyware infecting your computer? You can never take your <a href="http://www.cpusecurity.com/" target="_new">computer security</A> or internet security too seriously. One small infection is all it takes to cause thousands of dollars worth of damage to your system and you data. Learn more about computer security issues here -> <a href="http://www.cpusecurity.com/" target="_new">http://www.cpusecurity.com</A>

Computer Forensics Help to Solve All Kinds of Crimes

Computer forensics are used in many fields, from legalities involving trade secrets to prevention of computer-related fraud; however, mor...

Using Computer Forensics in the Real World

It seems that since time began we have been dealing with people trying to steal from their neighbors. Today's thieves are not only stealing tangible items but personal and technological information from computers that can cost businesses and people in the private sector millions of dollars. A new career opportunity has developed in the area of computer forensics that is teaching people how to protect computers from being accessed illegally and how to find who may have accessed a computer without permission.The department of computer crimes is now looking for experts in the area of computer forensics training. Many police departments have begun sending their detectives, who have an interest, to college specifically to earn a degree in this area. These students will be required to take courses in computer hacking, finding hidden data on hard drives and more. The training will also provide information on how businesses can prevent their computers from this type of crime.Computer forensics training will supply you with all the techniques and knowledge needed for this particular job. This will also include data recovery for lost, deleted of encrypted files and deciphering what criminal acts have been committed for trial purposes.No matter how careful a thief may be they always leave behind some kind of evidence that can only be discovered with computer forensics. At training classes you will be given access to and learn the latest technology, tools and programs to enable you to do this type of detective work. This is the only way to effectively prosecute a computer thief.Most forensic classes offered at colleges are the same although there may be a few subtle differences from one school to the next. These classes will take some time and effort to complete but in the end you will have a certificate that will get you employed with a high paying company in almost any part of the world.After graduation you will have the knowledge necessary to combat computer fraud, hacking and other crimes in these technological times.	 	 		 			 				 					 						<a href="http://www.squidoo.com/pccomputerforensicstraining" target="_new"> Computer forensics training</a> offers valuable career opportunities and is commonly offered at most colleges, universities and other educational institutions. Get more information on computer forensics. Visit computer forensics training now <a href="http://computerforensicstraining.net" target="_new">http://computerforensicstraining.net</a> to learn more.

Using Computer Forensics in the Real World

It seems that since time began we have been dealing with people trying to steal from their neighbors. Today's thieves are not only st...