IT Forensics: When crime scene investigations go digital
Published: 24 Apr 2006 13:30 BST
While a deep and highly technical understanding of computers is essential, candidates also need to have investigative skills, be good at writing reports and have the presence and authority to present findings in court as expert witnesses. This means that, while recent graduates of highly regarded MSc courses from universities such as Glamorgan and Cranfield may have the right academic background, they are unlikely to have garnered the necessary experience, particularly of being cross-examined in court. This means that if they are taken on, they should ideally be under the guidance of a more seasoned investigator.
"An examiner has to have many strings to their bow, which is why most of the good ones tend to be in their 30s and 40s. It's not a hard and fast rule, but in my experience, investigators tend to be a bit older as younger people don't have the life experience and such an in-depth knowledge of IT over a wide subject area," says Douglas.
Another thing to look out for, however, is knowledge of the Association of Chief Police Officers' guidelines, which are used as the de facto standard for digital forensics investigations worldwide and lay down four key principles for the gathering and usage of evidence.
But before even getting to the stage of hiring an expert, there are certain considerations that organisations themselves need to be aware of. The first and most important one is that computer evidence is very fragile and that it is easy to corrupt evidence by mishandling it. Simply turning on a Windows XP-based PC, for example, changes approximately 600 files of potential evidence such as dates and fields, which in one fell swoop become inadmissible in court.
Once a problem is suspected, it becomes important to preserve the potential crime scene and prevent the computer from being played about with further. If someone inexperienced fiddles around to try and find traces of illicit activity themselves, it immediately becomes too late to pursue the case because the chain of evidence has been destroyed.
As a result, the normal procedure for examiners is to isolate the machine by bagging and tagging it and placing it in a locked room so that they cannot be accused in court of polluting evidence. They subsequently take an image of the hard disk using specialised tools and analyse it in accordance with the parameters set by the customer. An audit log is also created so that a work trail can be followed and a report of the findings is submitted to the client at the end of the investigation.
A decision can then be taken based on the evidence as to whether to pursue legal action or not, but a rule of thumb is to assume that the case will go to court and to approach the matter with that in mind from the outset.
In the commercial sphere, many such investigations simply comprise searching through emails and documents or looking for evidence of files being downloaded or copied, but it can also include searching for items that have been deleted in an attempt by miscreants to cover their tracks.
As Simon Janes, international operations director at digital forensics consultancy, ibas, points out: "Much of the real value evidence is not what you'd find on the screen. It's often in the system files and unallocated areas where you find the real facts so you have to know what you're doing."
One of the problems with undertaking investigations of this type, however, is that it can cause disruption to the business, especially if a number of machines are involved, and so it has to be worth the organisation's while to make such a serious commitment.
As to what the future holds, meanwhile, it seems probable that over the next three to five years, as risk mitigation continues to creep higher up the corporate agenda, digital forensics will become more commonplace as companies of all sizes discover that incident management is no longer enough.
This is not least because digital technologies, ranging from mobile phones to PDAs and global positioning systems in cars, are becoming ever more integrated into people's daily lives and so demand for specialists that can analyse data to establish exactly what happened, how and when is only likely to grow.
As Douglas concludes: "When the outcome has a high stake, then it becomes only natural that the boardroom will want to deploy every tool that it can in order to get a handle on the situation."
Previous
Did you find this article useful?
227 out of 440 people found this useful
- Share this article:
