Computer Forensics Overview

Have you ever wondered where the commonly accepted perception of cyber investigations comes from? You might be surprised to find out that the world of suits, ties, and data terminals is far from the reality of what these investigations are--or, at least, considerably more dramatic. For today’s tech term, we’re going to get to the bottom of this by investigating what computer forensics really looks like.

What Are Computer Forensics, and What Are They Used For?
Computer forensics is generally considered the application of special processes and techniques that can be used to analyze information on a computer or network. Forensics are also generally meant to protect evidence that could potentially be used in a trial. Once the warrant required has been issued, a forensic technician will go on-site to isolate the device from the Internet or other attached networks that could influence its contents. They then copy over every file on the device and dig through them for anything of note. It’s important that the investigator makes a copy of each file so that the original evidence can be preserved. Even something as simple as accessing a file can lead to slight alterations, making the evidence of little consequence in a court of law, civil or criminal case.

Computer forensics can be used for any number of different cases. Depending on the nature of the crime, any device could be used to obtain evidence of what is, was, or will be happening. These types of investigation take an extremely close look at the data, including not just the files that are currently there, but at the metadata for just about any items on the device. This includes looking at when the file was first created, when it was edited and saved, and who might have been the one to carry out these actions.

This process can be used to solve any number of cases. Here are just a couple to look at as an example:

• Intellectual Property Theft and Industrial Espionage
• Employment Disputes
• Bankruptcy Investigations
• Inappropriate Email and Internet Usage in the Workplace
• Regulatory Compliance
• Forgeries and Fraud Investigations

Alternative Sources of Analysts
Law enforcement agencies are certainly not the only ones that place an emphasis on computer forensics. There are many others that also have accredited laboratories. You might be surprised to hear about a couple of these, as they include Walmart, American Express, and Target (which is kind of hilarious in the wake of the Target data breach not too long ago). There are also numerous independent labs that, while lacking accreditation, can potentially outperform law enforcement agencies under the right conditions.

Independent labs are often onboarded by law enforcement to help with crime solving. The perfect example of this is Target, whose labs have helped with “felony, homicide, and special-circumstances cases” in the past. These claims come from a spokesperson who, in 2008, claimed that about a quarter of cases managed by Target’s forensic laboratory were external and had nothing to do with the company itself.

How Does Your Technology Compare?
If your organization would like a team on your side to ensure that security is always a top priority, reach out to Macro Systems at (703) 359-9211. We aren’t a dedicated computer forensics agency, but we know all about network security and compliance issues.