Question:
As part of the auditing team in capacity of a Digital Forensics expert, prepare digital forensics investigative plan to enable a systematic collection of evidence and subsequent forensic analysis of the electronic and digital data. Assuming all systems are Windows based, this plan should detail following:
1. justify why use of the digital forensic methodology and approach is warranted including procedures for corporate investigation.
2. describe the resources required to conduct a digital forensic investigation, including team member skill sets and required tools.
3. outline an approach for data/evidence identification and acquisition that would occur in order to prepare the auditors for review of the digital evidence.
4. outline an approach and steps to be taken during the analysis phase making the assumption the computer system is a Microsoft Windows-based computer.
5. create a table of contents for the investigative plan describing what the primary focus of the report would be.
World philosophies are starting ever-increasing needs on digital systems and networks. This reliance is charming ordinary and in certain cases essential in numerous people’s has some types of standard day-to-day actions which presumes considerable similarity to the additional traditional variations that have enthused in to adjust our lives, the obtain ability of digital technology unavoidably leads to misappropriation by anti-social or wicked persons as well as normal populations.
Digital Forensic is a division of forensic discipline that involves investigation of contents and material present in any digital devices often Computers and Mobiles. It know how to have number of use in order to support any hypothesis or evidence in courts. Whenever the crime involves any network or computer it is termed as Electronic or Computer offense. Such crime are frequently committed either next to any individual or it involves a group maybe a company or any organization.[1]
Digital Forensics provides Digital evidence associated with e-crime. Digital evidence is any information stored in the form of binary digits and can be offered in court. It can be any hard drive, a CD, a flash card or a mobile phone. An additional vital feature of any digital forensic is that it can be used as private investigation while following legal consideration and international legislation.
Thus in order to proceed in any investigation, a digital forensic investigation plan is developed which includes different forensic methodologies to be followed after analyzing the whole case and then preparing an outline of the procedure followed along with the evidence.
In this case study a computer forensic team and laboratory needs to be setup including the necessary equipment and facility required. Total budget involved in the setting needs to be determined along with the type of experts needed in the team and thus creating a Digital forensic plan.
Before hand deliberating the present awareness with regards to the forensic science, this conversation emphases on phases usually elaborated in familiarizing society’s idea of hatefulusage of numerous technologies.
Founded on these phases, the complexity of their applicationconverts to a gathering of numerousconnected factors.
Till now, movements to report both of these connectedinfluences have been carefullyassociated with the construction and development of maximum forensic corrections.
Normal forensic examination methods comprise the subsequent:
We can see in broad way as:
a) Identification – recognizing a happening from indicators and crucial its sort. this can be not expressly at intervals the sphere of forensics, however important as a result of it impacts alternative steps.
Here the case is identified as misuse of emails and leaking of crucial information from the main office desk.
b) Preparation – making ready the techniques we need to apply using tools aided for applications like search warrants, and watching authorizations and management hold up.
Preparation of an investigation plan to proceed is done in this step.
c) Preservation – cut off, protect and conserve the condition of physical and digital proof. This comprises stopping individuals from victimization digital device also permitting alternative magnetic attraction devices which are needed to be utilized at intervals associate affected radius.
d) Assortment – documentation of the physical view and photocopy digital evidence victimization homogeneous and conventional procedures.
f) Examination – in detail methodical search of proof concerning the suspected offense. This centers on distinguishing and position probable proof, presumably at intervals unusual locations.
Proper Documentation and legal legislation requests to be followed and scrutinize in order to catch the suspect.
g) Presentation – Recapitulate and supply rationalization of wrapping up this could be in print in an exceedingly common person’s terms victimization abstracted classification. All abstracted classification ought to allusion the particular particulars.
After collecting relative information and evidence it can be presented in an investigation report format to the concerned official and discuss its consequences.
h) Returning proof – guaranteeing substantial and digital correctly is came to appropriate owner similarly as crucial however and what criminal proof should be detached. once more not an exact forensics step, but any representation that grab hold of proof seldom deal with this facet.
Proper investigation will always lead to the correct suspect with proof.Different Forensic equipment used helped in locating the evidence and the case comes at final step.
The massive common of investigative methods laboring by old-style forensic science cultivated out of laboratories.
Finished time, supplementary federal, public, and local powers that be understood the significance and requirement of methodical examination. Specialist with specific attention in the forensic characteristics of investigation initiated to change over their observes to recently recognized laboratories that absorbed on forensic investigation in upkeep of the courts. This tendency leftover true to this day, though, as detailed beforehand, forensic examination of computer structures has occupied a dissimilar evolutionary route.
In totaling, the courts also assumed that these investigative methods were not unquestionable. They were consequent by investigation that controlled (or should comprehend) procedures of fault and other catalogues to support pronounce the authenticity of figures and description results. This thought directed to the expansion of principles and guidelines of acceptability of professional demonstration that must escort scientifically consequent reference confirmation (Eckert, 1997)
Frequently in criminal chronicles, the courts and public views have derived to be dependent profoundly on assured confirmation consequent by the systematic method. Possibly the furthermost frequently quantified but minimum agreed is DNA profiling. This some what novel method is completed for the courts as a procedure recycled by criminological serologists. It is trusted upon since of its alleged capability to distinguish despondent to the side by side of the specific, as a result exchange other, elder methods comparable to blood typing for example a principal evidentiary contrivance.
Till very lately, the scientific communal has been noticeably inattentive from the expansion of values, procedures, and conventions connected to forensic examination of digital mechanisms. This tendency has commanded to court dependencies on instance relatively than arithmetical consequence and repeatability when governing on acceptability of suggestion consequent from digital foundations. As judges, juries, resistance prosecutors, and quality managers developed well-informed in digital technology and appreciate its complication entirely, it is probable that we will perceive the call for an additional difficult method to digital forensic examination.
When this practice activates, decision-makers will request additional convincing questions and anticipate more thorough, methodically established clarifications from those providing testament or convincing opinions. This novel opinion of proof, coupled with progressively active, networked surroundings, will strength a example change. This pattern change will gradually adjust law implementation’s usage of knowledge and permit for broader usage of forensic practices in commercial, business, management, and the military.
The forensic examination of computer systems, whether in provision of the courts or decision-makers in occupational or military processes, has the identical objective: persuasion based on factual evidence. The evidence essential be enough to assistance to bind a judge and jury to a judgment or assisting a decision-maker to alter supply distributions or operational objectives. At the essential, they are fundamentally matching but are acknowledged by dissimilar names.
Resources and Budget involved
Various Software help in the investigation process in case of any electronic crimes and thus their utilization comes into existence. The resources required would be some hardwares as well as some softwares.Some of type of forensics needed to be done are
It is connected to the checking and study of computer network transfer for the reasons of in sequence meeting, legal proof, or interruption detection[5]
Wipe away or removing an email doesn’t of necessity denote that it is gone everlastingly frequently emails can be forensically take out even following removal. Forensic tracing of e-mail is alike to conventional police officer work.
As here in this incident the case is about misuse of email and network traffic. Hacking of some passwords and increase in number of spams are also some of the aspects to ponder. The resources required can be categorized on the basis of hardware and softwares.
|
S.no. |
Hardware |
Properties |
Estimated Cost |
|
1 |
Forensic Systems |
It consists of integrated processing platforms and it can handle challenging computer cases. It bring the aptitude to easily duplicate proof in a straight line from IDE/SAS/SATA drives, USB devices, Firmware devices, CDs, DVDs, LTO-4 tape and PC Card/Smartmedia/SD-MMC/Memory Stick/Compact Flash media in a forensically sound environment. |
$6,712 |
|
2 |
FREDC Forensic network |
A Forensic system is a sequence of dispensation and imaging computers linked and integrated in a straight line with a high-speed and high-capacity server to distribute resources. The file member of staff serving at table function as the core of the Forensic Network and can be used as a central storage facility for Forensic Images as well as applications software for use by the client processing and imaging stations. |
$4,671 |
|
3 |
Forensic devices |
Standalone forensic devices which address specific needs of the Computer Forensics Investigator |
$2,545 |
|
4 |
Other Accessories |
These accessories may include different adapters, enclosures, protocol modules and many more |
$1,289 |
The assembling team for forensics must include a number of experts ranging from the field of Law to the system expert. The experts to be included must in the team are
A Lead investigator
A lead investigator leads the case and identifies and analyses every aspect of case taken.
They have all basic knowledge in every proceeding and accomplishes task at his intelligence level
They gather clues, evidences and suspects and collects every detail of the proceeding
Co-Investigator
They assist the lead investigators in collecting relevant information and providing details to the other department members present in the investigation team.
They act as a bridge between the departments and lead investigator
Legal Expert
They are responsible for taking in account all legal considerations and legislation while collecting information.
They take into account every step and procedure being followed by the investigators under law.
They also advise the legal restrictions while investigation.
Security Department Officer
Their role is to provide information and evidence regarding the incidents that is happening.
They are accountable to all those security steps being followed and care taken in the organization.
Technical Expert
To carry out the identification process and analysis there comes the need of a Technical expert.
As we see here there is a misuse of email then respective software must be used by the expert to identify the loophole.
Conclusion
Events of dependability and correctness for the procedures and approachescast-off in examinationcustomarilyspread the level of self-assurancepredictable in the proof and complementarywitness. Evidenceconsequent from computer criminologicalinvestigation has however to be opposed to any excessive range by security lawyers in jurisdictional reports or specialists in inquiries of computer misapplication. Most procedurescast-off nowadays are anticipated conceivable if not unquestionablesince they are established by reliable companies, used by specialists or experts in the field, and recycled beforehand in benches or other backgrounds to influence experts.
In the nearby future, the gathering, synthesis, and association of data after all of these foundations and more will be self-motivated to soundings, both public and criminal. Of cumulativesignificance will be the requirement for suggestion, and the approaches and practices used to reveal it, to be precise, consistent, and recognized as average preparation in digital forensic investigation.
References
Computer forensic tool testing program, computer imaging specification, version 3.1.6, national institute of standards and technology. Available at: www.cftt.nist.gov
Eckert, w. G., introduction to forensic sciences, 1997, crc press.
Federal rules of evidence, article vii. Opinion and expert testimony, rule 702 & rule 703. Available at: www.house.gov/judiciary/evid00.pdf
Foster, k., r huber, judging science: scientific knowledge and the federal courts, 1997, mit press.
Koehler, j. J., a. Chia, s. Lindsey, , “the random match probability in dna evidence: irrelevant or prejudicial,” jurimetrics journal, 1995, winter, pp. 201-219.
Pollack j., us district court, pa: u.s. V plaza, acosta (cr. No. 98-362-10, 11,12), “strengthening the criteria for admissibility of fingerprint evidence,” judicial opinion.
Computer crime investigation & computer forensicssource: information systems security, summer 97, vol. 6 issue 2, p56, 25p.
an examination of digital forensic models” international journal of digital evidence fall 2002, volume 1, issue 3 mark reith, clintcarr, gregggunsch, department of electrical and computer engineering, graduate school of engineering and management,air force institute of technology,wright-pattersonafb, oh 45433-7765
Essay Writing Service Features
Our Experience
No matter how complex your assignment is, we can find the right professional for your specific task. Contact Essay is an essay writing company that hires only the smartest minds to help you with your projects. Our expertise allows us to provide students with high-quality academic writing, editing & proofreading services.
Free Features
Free revision policy
$10Free bibliography & reference
$8Free title page
$8Free formatting
$8How Our Essay Writing Service Works
First, you will need to complete an order form. It's not difficult but, in case there is anything you find not to be clear, you may always call us so that we can guide you through it. On the order form, you will need to include some basic information concerning your order: subject, topic, number of pages, etc. We also encourage our clients to upload any relevant information or sources that will help.
Complete the order form
Once we have all the information and instructions that we need, we select the most suitable writer for your assignment. While everything seems to be clear, the writer, who has complete knowledge of the subject, may need clarification from you. It is at that point that you would receive a call or email from us.
Writer’s assignment
As soon as the writer has finished, it will be delivered both to the website and to your email address so that you will not miss it. If your deadline is close at hand, we will place a call to you to make sure that you receive the paper on time.
Completing the order and download