The Imaging Section of the Forensic Report, Essay Example

The imaging section of the forensic report that needs to be submitted to the law enforcement agencies includes (National criminal justice reference service, n.d):

Examination and photograph of the computing device (which is used for an online crime)

Investigation of hardware along with documentation is conducted

Computing device was booted by a controlled boot disk and using the secure mechanism. Likewise, the computing device was powered on and the BIOS information is documented along with the time on the computing device. Moreover, the ‘boot sequence’ along with all the configured setting available on BIOS was documented.  Furthermore, after examining the ‘boot device sequence’ in the BIOS, boot from hard drive was already configured.

No changes were made to the BIOS of the computing device before powering off.

Forensic Tool that is utilized for collecting evidence encompasses an image of the computing device hard drive (Peterson & Sujeet Shenoi, ).

The computing device was connected via a null modem cable to the laboratory computing device. Moreover, the null cable modem is connected to the parallel ports.

The computing device was booted to the Disk operating system (DOS) with again a controlled bootable medium incorporated with a forensic tool that is initialized in an administrative mode.

The laboratory is comprised of a computing device that is connected to a magnetic optical drive for file storage. The computing device located in the laboratory was also booted to a DOS environment, again with the controlled bootable disk; forensic tool is initialized in a server mode. Likewise, evidence files from the computing device were acquired copied to the magnetic optical disks connected to the computing device located in the laboratory.

After the acquisition process, both the computing devices were turned off.

The computing device was maintained to the laboratory property room.

The magnetic optical disks including the data associated with evidence were set to write-protected and maintained as evidence.

Analysis Section

Analysis section includes the activity of performing data analysis on the data that is acquired by the computing device. Likewise, accepted forensic procedures are required to be followed and data analysis will not be conducted on the original evidence (National criminal justice reference service, n.d).

1. Operating system of a computing device that is located in the laboratory is Windows Server 2007, Forensic tool, other software programs.
2. Files that were retrieved by the forensic tool from the computing device of the suspect were replicated to the hard drive of the computing device located in the laboratory.
3. The case file known as the evidence files located in the suspect’s computing device is accessed by the forensic tool.
   1. Forensic tool recovered files that were deleted from the hard drive.
   2. Name of the files, time and data, sizes both in logical and physical along with the path were saved and documented.
   3. Keyword search is conducted on a certain criteria, as it is defined by the investigator. Moreover, all results of the keyword search were examined.
   4. Files that do not contain data, for instance, image files, were reviewed.
   5. Similarly, file formats related to the Internet were examined.
   6. Data files including encrypted data were also examined
   7. Identification of slack and unallocated spaces
   8. Evidence collected from the forensic tools ws completely deleted and copied to a separate disk.

Moreover, unallocated and slack spaces were also deleted from the forensic tools file and copied to a separate and clean hard drive that is distributed to the U.S. Department of Defense recommendations (DoD 5200.28-STD).

Furthermore, files that were password-protected, copied to a secure medium for retrieving passwords by incorporating password recovering toolkits (InfoWorld – google books). After cracking the passwords, the files were examined. One of them was a MS word protected file that was protected with the password : I AM GENIOUS

Findings

The analysis of the computing device led to a recovery of 200 files that were suspicious and may led to a clue associated with the crime. Likewise, the recovered files includes 100 files that can be categorized as documents, 40 files associated with image formats, 30 files that were associated with Internet formats for instance, XML, HTML, PHP etc., 20 graphical files that were retrieved from unallocated spaces and 10 files that were password protected or encrypted.

Summary

By examining the MS word document, summary of all the crimes was presented in a neat and clean way. This was the breaking point that may lead to other crimes that were not known to the investigators initially. Moreover, one of the image files illustrated a fake company card that was used for getting access in one of the largest companies. Furthermore, personnel who were involved in making the duplicate or fake company card were also traced and therefore, suspect along with his/her subordinates were charged punishment by the court of law.

References

National criminal justice reference service n.d  Retrieved 10/30/2011, 2011, from https://www.ncjrs.gov/

Peterson, G. A., & Sujeet Shenoi. Advances in digital forensics V: Fifth IFIP WG 11.9 international conference on digital forensics, orlando, florida, USA, january 26-28, 2009, revised … in information and communication technology) Springer.

InfoWorld – google books Retrieved 10/30/2011, 2011, from http://books.google.com/books?id=uFAEAAAAMBAJ&pg=PA124&dq=Password+recovery+toolkit&hl=en&ei=tjWtTrGxCIe68gPd7smqCw&sa=X&oi=book_result&ct=result&resnum=1&sqi=2&ved=0CCoQ6AEwAA#v=onepage&q=Password recovery toolkit&f=false