Journal Computer Forensics & Data Remembrance

Keyboard cops
San Francisco , Jun 04, 2005 @ 18:02 GMT
Even though this article was written in 2005, I was really surprised how detailed and descriptive it presented the benefits of Computer Forensics and Data Remembrance. They emphasized that computer forensic analysts are in demand since electronic evidence has become critical in solving crimes. An internet bookmark or deleted e-mail can be vital to securing a conviction. They list incidents quite interesting and why computer forensics is so important.
In South Dakota, a woman was found drowned in her bath with high levels of temazepam in her blood. It looked like suicide - until investigators looked at her husband's computer and found he'd been researching painless killing methods online. With this evidence, prosecutors were able to convict him.
Today, says Frowen, "they seize computers in murder, rape and fraud cases. Almost every crime at some point touches a computer." It's crucial that the evidence stays intact, so digital forensic examiners never work directly on suspects' computers. "Every time you look at a file, it changes - the date stamp, for instance, would register the day and time you opened the file, contaminating the evidence," says Neil Barrett, a professor of criminology at Cranfield University and the author of Traces of Guilt (Corgi, 2005). "We preserve digital evidence using a method known as 'imaging' or 'freezing'. A suspect's hard drive is removed and put in a computer that is 'write blocked' and can't write to the disk. A forensic image is then taken of that hard drive - an exact clone that can be examined."
The mantra is: delete doesn't mean gone. Deleting a file, emptying the bin or even reformatting a hard drive will not necessarily get rid of evidence. This is because computers retain data even after it has been deleted. Not surprisingly, software is available that deletes and overwrites data. Software like CyberScrub (http://www.cyberscrub.com/), claims to "remove all evidence of online activity, erase previously 'deleted' files, and securely destroy e-mail". Such programs have legitimate uses - bank details or health records would be at risk if you sold your computer or others gained access to it.
"The criminals should be one step ahead of us, because all they need do is encrypt their files. Yet those we catch rarely do this. Maybe we're only catching the idiots.
The field of computer forensics is constantly evolving to keep pace with new devices. Any device that can store data can be used to harbor indecent images, illegal software or fraudulent documents. But criminals should heed the words of the computer forensics expert John Mallery: "The only secure computer [or digital device] is the one you never turn on, bury in the ground and cover with dirt."