Computer forensics is the scientific process of capturing (imaging) and analyzing information stored in any electronic format, for the purpose of investigating allegations, to find the truth, with no predisposition as to the outcome. It is a highly technical discipline requiring a combination of unique skills relating to computer technology and software, formal investigative experience (law enforcement), proper evidence handling methods, and judgment. Computer forensics can be the key to:
- Learning the truth
- Taking appropriate action based on the facts
- Winning the case.
What are the Challenges?
Many challenges are involved in effectively utilizing the power of computer forensics including:
Employers, HR representatives and internal and external legal counsel are often not aware of the information available on computer systems or the resources at their disposal to capture this information. Often, decisions are made based on interviews or perceptions when the facts are readily available on a nearby system.
Performing electronic discovery and forensic analysis on large volumes of information can be complex and time consuming. Given the unique skills required and the potential costs involved, it may be reserved for more involved situations. In truth, computer forensics can benefit any size case at an affordable price.
Some of the services to offer your service in forensics are listed below:
- Digital Fraud
- Inappropriate Data Duplication
- Authorized Data Duplication
- Bankruptcy Data Investigation
- Private Investigation of Personal Computer
- Private Investigation of Cellphone/Mobile Phone
- Private Investigation of PDA
- Blackberry Forensic Examination
- Disloyal Employees
- Industrial Espionage
- IP Theft
- Breach of Contract
- Computer Break-ins
- Phone ‘Phreaking’
- Digital Pornography
- Inappropriate Internet Usage
- Internet Abuse
- Inappropriate Email Usage
- Email Abuse
- determine the veracity of allegations or if company policy has been violated;
- Ensuring the confidentiality of the process and impartiality of the investigator;
- Minimizing risk and the potential cost of downstream actions.
- Discovering the facts early, before a situation becomes unmanageable, saves time and money. Proactive forensic investigation is a unique tool that should be in every organization’s toolkit.
Should the IT Department do the Analysis?
In the electronic-discovery process, the methods used to obtain relevant data are as important as the data itself. The process should be viewed from the beginning as a preparation of evidence that will survive the scrutiny of a courtroom. Issues with internal IT resources conducting the investigation include:
- Internal IT resources may not be perceived as objective since they are employed by a party involved in the case;
- Any curious “peeking” at the evidence could be construed as tampering and could result in files being altered from their original state;
- Individuals involved in the investigation could be called upon to testify as expert witnesses: an experience for which they are likely unprepared;
- The chances of spoliation and evidence contamination increase when proper forensic techniques are not applied;
- Confidentiality: Will there be “water cooler talk?”
Effective forensic analysis and investigation is most effective when conducted by an impartial, third party with the necessary technical and law enforcement background.