National Standards, Research Paper Example

National standards that certify testing boundaries are called as American Society of Crime Laboratory Directors (ASCLD) (Pepper, n.d). This society is responsible for setting the standards, management practices, and audit functions for laboratories utilized in crime investigation analysis and computer forensics. Computer forensics functions in the laboratory are utilized by the law enforcement agencies i.e. Federal Bureau of Investigation, Police and other associated organizations. Moreover, other bodies that are engaged in certifying a digital forensic laboratory, as the inspection of the lab is carried out by external sources such as International Society of Forensic Computer Examiners and International Association of Computer Investigative Specialists and Global Information Assurance Certification. The American Society of Crime Laboratory Directors/Laboratory Accrediting Board is involved in the process of accrediting forensic crime investigation laboratories since 1982 (Tilstone, 2006). The primary purpose of complying to national standards or by attaining accreditation, a standardized approach to establish management practices, operational processes, procedures, security, equipment and health and safety is established. The forensic investigation laboratory is able to conform and comply with these established national and international standards. Likewise, these standards are flexible and can be feasible for any size of forensic investigation laboratories located anywhere around the globe.

Laboratory Components and Equipment

The components of the forensic analysis laboratory incorporates workstations, specialized hardware, specialized tools, physical security, workbench, discussion tables, separate cabins equipped with forensic investigation workstations. Workstations are of two types, one is only associated with entering data spreadsheets and taking print outs. However, the other workstation is empowered with all the necessary software, hardware and tools that will be utilized for forensic investigations. The use of a specialized hardware is applicable in certain cases, where advanced technologies are incorporated. Next, tools are considered to be the core components of forensic investigations, as they are specific and focused to perform a designation tasks accurately and efficiently. As the preservation of evidence is stored in the record room of the lab, physical security is absolutely essential. Surveillance cameras and biometric door entries can be considered for this purpose. Workbench is another component of the investigation process that provides a controlled environment for perform hands on knowledge to the practical world objects. As forensic examiners work on this bench to analyze and examine missing fragments of evidence. Furthermore, separate cabins are established to keep two cases separate, as they can create misperception and the focus of forensic investigators. For determining that equipment is mandatory for a forensic investigation laboratory, there are certain things that should be considered:

• The type of investigation and frequency of projects
• Projects are coming from a small medium enterprise or corporate organizations frequently?
• In case of corporate organization projects, only internal investigations are carried out or internal and external investigations are carried out?
• Carrying out forensic analysis investigation externally may require a completely different package of capabilities as compare to internal investigations.
• For utilizing computing devices, they will be used only for imaging purpose? If the computing devices will be utilized for forensic analysis investigations, they will be only specific to analysis platform or they will be utilized for every required process?

Working Conditions

The working environment of the forensic laboratory will be spacious but not too spacious, as all the wirings including network cables, telephone wires, electrical power, alarm system, bio metric system and appropriate ceiling to wall distance will be incorporated around the laboratory boundaries. The storage cabinets must be stored in a separate and secured room with adequate distance, in case of more than one or two storage cabinets. These storage cabinets are used for preserving evidence and are mandatory to be protected. A table for both i.e. forensic investigation workstation and a normal workstation used for data entry or research, number of chairs = number of employees, workbench size depending on the number of forensic experts is a part of working conditions of a forensic analysis laboratory. However, the size of the laboratory will contribute to a major factor i.e. the capacity of number of workstations and furniture. The room for securing and storing digital evidence is equipped with physical, logical and technical security controls. Moreover, sensors for climate control i.e. heating and air conditioning are also in place. For good visibility, proper lightning is employed at the ceilings and on the work benches. Lastly, selecting tools is based on required hardware resources compare to current hardware resources, required storage space and current storage space.

Computer Memory Analysis Tool

The analysis tools targeting computer memory are significantly becoming widespread day by day, as for the field of digital forensics. Valuable indicators are retrieved from volatile memory analysis, as they guide the investigators what to search on a hard drive and facilitate in retrieving passwords from encrypted hard drives (Chow & Shenoi, n.d). By incorporating a single tool is considered to be an efficient practice, as it impacts less on the state of the system that is called as ‘Potential Evidence’ (Chow & Shenoi, n.d). One of the tool named as CMAT that is a self-contained tool is used for extracting forensic data from a memory dump and converts it in a format that is capable for further analysis. It is often a case when malware is not detected by various advanced computer forensic tools, as the presence of malware in the memory dump has proved to be a valid option. Moreover, RAMMAP is another portable and stand-alone tool that facilitates the forensic investigator to review precisely the assignment of physical memory on a Windows based operating system. The tool not only demonstrates memory usage, it links individual files with the memory usage. Accordingly, the forensic investigator can evaluate and examine the exact allocation of drivers associated with the memory, cached files, dynamic link library etc. Comprehensive and rich information that the GUI of RAMMAP shows include (RAMMap – physical memory analysis tool):

• Use Counts: usage summary by type and paging list
• Processes: process working set sizes
• Priority Summary: prioritized standby list sizes
• Physical Pages: per-page use for all physical memory
• Physical Ranges: physical memory addresses
• File Summary: file data in RAM by file
• File Details: individual physical pages by file

References

Chow, K., n.d, & Shenoi, S.Advances in digital forensics VI: Sixth IFIP WG 11.9 international conference on digital forensics, hong kong, china, january 4-6, 2010, revised … in information and communication technology) Springer.

Pepper, n.d, I. L.Crime scene investigation: Methods and procedures Open University Press.

RAMMap – physical memory analysis tool Retrieved 8/9/2012, 2012, from http://www.technibble.com/rammap-physical-memory-analysis-tool/

Tilstone, 2006, W.Forensic science: An encyclopedia of history, methods, and techniques ABC-CLIO.