Computer Forensics Through the Years
Prof. Pepin Galarga
Computer Forensics
Sep 11, 2010

Table of Content

Introduction …………………………………………………………………………………Page 2
The Early Years……………………………………………………………….......................Page 3
Early Training Programs …………………………………………………………………....Page 4
Typical Aspects of Computer Forensic Investigations ……………………………………..Page 5
Legal Aspects of Computer Forensics …………………………………………..……...…..Page 6
Conclusion ………………………………………………………………………………….Page 7
References………………………………………………………………………………..…Page 8

Introduction

If you manage or administer information systems and networks, you should understand computer forensics. Forensics is the process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts. (The word forensics means “to bring to the court.”) Forensics deals primarily with the recovery and analysis of latent evidence.
Latent evidence can take many forms, from fingerprints left on a window to DNA evidence recovered from blood stains to the files on a hard drive.
Because computer forensics is a new discipline, there is little standardization and consistency across the courts and industry. As a result, it is not yet recognized as a formal
“scientific” discipline.
Image by Flickr.com, courtesy of Steve Jurvetson Computer forensics is the study of extracting, analyzing and documenting evidence from a computer system or network. It is often used by law enforcement officials to seek out evidence for a criminal trial. Government officials and business professionals may also have need of a specialist familiar with computer forensic techniques. The discipline of computers forensics is relatively new, having been founded in the 1980s.
Computer Forensics can be use for the purpose of performing a root cause analysis of a computer system that had failed or is not operating properly, or to find out who is responsible for misuse of computer systems, or perhaps who committed a crime using a computer system or against a computer system. This being said, computer forensic techniques and methodologies are commonly used for conducting computing investigations - again, in the interest of figuring out what happened, when it happened, how it happened, and who was involved.
The Early Years

The field of computer forensics began in the 1980s, shortly after personal computers became a viable option for consumers. In 1984, an FBI program was created. Known for a time as the Magnetic Media Program, it is now known as the Computer Analysis and Response Team (CART). Shortly thereafter, the man who is credited with being "the father of computer forensics" began work in this field. His name was Michael Anderson, and he was a special agent with the criminal investigation division of the IRS. Anderson worked for the government in this capacity until the mid 1990s, after which he founded New Technologies, Inc., a leading computer forensics firm. New Technologies Inc experience is primarily in investigations and computer evidence processing. In 2000, NTI was acquired by Armor Holdings, Inc. a New York Stock Exchange listed public corporation and became part of Forensics Source, the largest supplier of forensics equipment and supplies in the world. NTI has made it a priority since 1996 to support US government agencies in this important effort and most of their software tools are designed with classified government agencies needs in mind. Because of NTI's extensive experience in computer forensics and the presentation of evidence in court, NTI also provides consulting services to civil litigation law firms. Since 1996, NTI has trained computer specialists from numerous government agencies, over 140 Fortune 500 corporations, all of the Big 4 accounting firms and numerous law enforcement computer crime units. The qualifications and credibility of NTI's training team is unsurpassed and includes some of the top computer forensics experts in the world. The majority of the NTI professional staff has extensive law enforcement and military experience.

Early Training Programs

A meeting held in 1988 in Oregon led to the formation of the IACIS (International Association of Computer Investigative Specialists). IACIS is an international volunteer non-profit corporation composed of law enforcement professionals dedicated to education in the field of forensic computer science. IACIS members represent Federal, State, Local and International Law Enforcement professionals. Regular IACIS members have been trained in the forensic science of seizing and processing computer systems. IACIS prides itself on being the world's leading organization for computer forensics practitioners. In addition to providing the highest quality computer forensics training, IACIS strives to foster excellence in the field through a formal certification process.
Shortly after that, the first classes were held to train SCERS (Seized Computer Evidence Recovery Specialists). The SCERS training program teaches fundamental forensic techniques for the analysis of electronic data from desktop computer systems and selected peripherals. While the course is an advanced training for FLETC, it is designed as a comprehensive digital forensics foundational course of instruction for novice examiners or those who wish to update their skills. The SCERS training program is an intense course that requires substantial computer aptitude and prior computer training. SCERS teaches the proper methodology for acquiring digital evidence in a forensically sound manner, and teaches how to analyze this data. They are two distinct skill-sets and both are required for offices where the digital evidence examiner must also respond to the scene and collect the evidence.

Typical Aspects of Computer Forensic Investigations
From a technical standpoint, the main goal of computer forensics is to identify, collect, preserve, and analyze data in a way that preserves the integrity of the evidence collected so it can be used effectively in a legal case.
First, those who investigate computers have to understand the kind of potential evidence they are looking for in order to structure their search. Crimes involving a computer can range across the spectrum of criminal activity, from child pornography to theft of personal data to destruction of intellectual property. Second, the investigator must pick the appropriate tools to use. Files may have been deleted, damaged, or encrypted, and the investigator must be familiar with an array of methods and software to prevent further damage in the recovery process.
Two basic types of data are collected in computer forensics. Persistent data is the data that is stored on a local hard drive and is preserved when the computer is turned off. Volatile data is any data that is stored in memory, or exists in transit, that will be lost when the computer loses power or is turned off. Volatile data resides in registries, cache, and random access memory (RAM). Since volatile data is very sensitive and can last very short, it is essential that the investigator knows reliable ways to capture it.
System administrators and security personnel must also have a basic understanding of how routine computer and network administrative tasks can affect both the forensic process (the potential admissibility of evidence at court) and the subsequent ability to recover data that may be critical to the identification and analysis of a security incident.

Legal Aspects of Computer Forensics
Computer forensics is a relatively new discipline to the courts and many of the existing laws used to prosecute computer-related crimes, legal precedents, and practices related to computer forensics are in a state of flux. New court rulings are issued that affect how computer forensics is applied. The best source of information in this area is the United
States Department of Justice’s Cyber Crime web site. The site lists recent court cases involving computer forensics and computer crime, and it has guides about how to introduce computer evidence in court and what standards apply. The important point for forensics investigators is that evidence must be collected in a way that is legally admissible in a court case.
Increasingly, laws are being passed that require organizations to safeguard the privacy of personal data. It is becoming necessary to prove that organizations are complying with computer security best practices. If there is an incident that affects critical data, for instance, the organization that has added a computer forensics capability to its arsenal will be able to show that it followed a sound security policy and potentially avoid lawsuits or regulatory audits. If system administrators possess the technical skills and ability to preserve critical information related to a suspected security incident in a forensically sound manner and are aware of the legal issues related to forensics, they will be a great asset to their organization. If an intrusion lead to a court case, the organization with computer forensic capability will be at a distinct advantage.

Conclusion