Preparing a Computer Forensics Investigation Plan, Research Paper Example

Introduction

In dealing with the development related to the digital age, it could be analyzed how some crimes are duly related to the utilization of different digital resources. Understandably, such instances suggest the need for the investigators to focus on how such digital resources could be explored hence provide great help in the process of solving a particular criminal case. In line with this development in the field of criminal investigation procedures, the introduction of computer forensics have been given way in the field of police operations.

In relation to the Federal Rules of Evidence or FRE, the use of digital evidences have already been considered as a controlled issue ever since the 1970s when the first computer-defined gadgets have been introduced to the society. Nevertheless, the application of firmer rules about the matter have only been established in 1984 and have been strictly considered by the FBI Computer Analysis and Response Team or FBI-CART (CFIP, 2012, Internet). What prompted such an application is the increasing rate of criminal cases that are dependent on the use of digital resources. Later on as the crimes related to computer-based operations become more complex, FBI-CART and the Department of Defense Computer Forensics Laboratory or DCFL teamed up together to come up with viable research and training to handle the rising demand for better computer forensics methodologies (Olzak, 2007). In the discussion that follows, several aspects of computer forensics shall be defined hence creating a reliable indication of development that the industry of computer forensics have already incurred in the past years. This discussion aims to point out how such developments improve the investigation procedures that are being undergone by police officers in this digital-dependent society.

Preparing a Windows-based Computer for Forensics Investigation

Since Windows is the most prominent OS that most computers use, the creation of tools that could help professional investigators in the process of exploring the evidence sources have been introduced. In line with this, proper methodology should be considered by the investigators involved. To note, these methodologies are better defined under the two primary legal foundations of computer forensics which could be noted as follows:

1. The investigators are directed only to get viable data that could help in the process of investigation and not go beyond this jurisdiction. (CFIP, 2012, Internet)
2. The investigators are required to avoid any possible actions that could jeopardize their position and the legal stand of the institutions for whom they are handling the said investigative explorations for. (CFIP, 2012, Internet)

Both terms of legalities are expected to provide definite condition of dependence on the suspect’s right to privacy. This is especially true when the case being handled is high profile. To guide the investigators in the process, there are often clear privacy policy documentations presented prior to the actual investigation of the digital evidence. Following these clauses of “code of conduct” specifically protects both the investigator and the owner of the suspect being investigated upon from going overboard the legal measures of concern (Morris, 2010).

When it comes to logging into the system, there are several software tools that investigators use for digital exploration. One of which is the TASK or the The@stake Sleuth Kit which is usually used along with the Autopsy Forensic Browser. The TASK program allows the investigators to see images as well as retrieve particularly deleted files that could still be found within the systems directory. These operative tools also work well with LINUX and MAC OS X and are relatively reliable to consider investigating on a Windows File platform. Careful utilization of these tools are highly required from highly trained computer forensic investigators as the small mistake of utilizing them improperly could result to the alteration of the evidences collected which could be subjected to legal sanctions.

Most often than not, it is the idea of digging deeper into the system that matters most in an investigation. The most important elements that could contribute to the process of investigation are often removed or deleted by the owners of the computers for harder tracking. Data open recovery systems could be utilized to handle such considerations. Unless the drive has already been overwritten, the data that has been deleted and removed from the recycle bin can still be retrieved fully. Through the effective use of pattern file characteristics, finding essential files viable for investigation is indeed possible.

Encryptions and the utilization of passwords often present a more daunting task for investigators. Decrypting such private keys or passphrases often involve deeper investigation that would subject the personnel handling the case to search for possible storage sources both in and outside the computer’s system which the suspect could possibly use to store important data in case the passwords are forgotten.

Use of Digital Evidence in a Criminal Proceeding

The fourth amendment of the law of search and seizure specifically provides viable protection to all people [even those who are suspected of committing a crime] from being overly exploited under particular courses of investigations. This is what conveys the need of investigators to be extra careful in the manner by which they handle their investigating responsibilities. In the course of not doing what the amended law has required, all evidences collected from the investigation could be rendered valueless and irrelevant to the investigation of the crime.

For the digital evidence to become useful in defining a criminal case, the investigators should be able to define personal property apart from other forms of files that may not belong to the individual/s being investigated upon. There are instances when those being investigated upon are part of a company who also holds files for the organization. Distinguishing differences between the said files could protect the capacity and the credibility of the gathered data to provide solid evidence to a crime.

In a way, the determination of a data’s worth to the person being investigated upon identifies its worth in line with the case being explored (Morris, 2010). Relatively, the files gathered that have been collected under the proper application of the jurisdiction of the suspect’s right to privacy are the only ones that can be considered viable for court use. Anything that goes beyond the clauses of one’s right to privacy could b used against the credibility of the investigator’s work hence rendering such evidences useless (CFIP, 2012, Internet).

Conclusion

Since computer systems are constantly changing over time, it is expected that the crimes perpetrated through the said digital gadget would also become more complex in the near future. In relation to this, it is hoped that the digital forensics industry would be able to acquire more defined procedures that could help in the process of easing out the need to gain data from several computer gadgets. Developing software programs that are highly technical to access coded files, encrypted data and other possible digital evidences would help so much in improving how crimes handled through complex computer systems could be solved fully.

Legalities and other regulations that are related to the investigation ought to be redeveloped as well hence providing better protection for the investigators in support of what they are doing and the credibility of evidences that they are carrying. This would allow the investigators to see better on what specific files and data could define the distinctive path of criminal investigation that must be met and completed for the case.

References

Olzak, T. (2007). Computer forensics: Preparing for electronic evidence acquisition. http://www.techrepublic.com/blog/security/computer-forensics-preparing-for-electronic-evidence-acquisition/223. (Retrieved on August 2, 2012).

Computer Forensics and Investigation as a Profession. http://www.cps.brockport.edu/~shen/cps301/figures/figure1.pdf. (Retrieved on August 2, 2012).

Morris, J. (2010). Forensics on the Windows Platform, Part One. http://www.symantec.com/connect/articles/forensics-windows-platform-part-one. (Retrieved on August 2, 2012).