Computer Compensics: The Study Of Computer Forensic

ICT504

Computer Forensics

INTRODUCTION

Computer Forensics is a process used to locate digital information that may be used to help prove guilt or innocence.Computer forensics is the study of science which is used to obtain, preserve and document suggestion from electronic devices like USBs, computer, PDAs, cameras, mobile phones. Generally information is stored in digital devices in the form of binary digits. Devices used to store information are as follows: - computers, hard disk, CD-ROM, email, JPEG image in network. It has three roles as a lawyer, detective and cyber analyst. In case of lawyer, investigations done are Divorce cases, Insurance and corporate investigation. As a detective, it is known as “detectives of the digital world.”

Digital photographs of the scene are also taken before any hardware is dealt with. The way in which the hardware is dealt with, and specifically the hard drive is by the use of imaging. First task is to make a compete bit stream backup of all computer data before review or process. Bit stream backups (also referred to as mirror image backups) involve the backup of all areas of a computer hard disk drive or another type of storage media, e.g., Zip disks, floppy disks, Jazz disks, etc. Such backups exactly replicate all sector on a given storage device. Thus, all files and are copied. Bit stream backups are sometimes also referred to as 'evidence grade' backups and they differ substantially from traditional computer file backups and network server

Preserving data is challenging for businesses, law firms, and government agencies given the tremendous volumes, sources, and types of data potentially involved. This sensitive information must also be secured quickly to prevent it from being overwritten, destroyed, or otherwise spoliated. To properly preserve data, you need the right tools and methods to ensure all potentially relevant data is captured and remains intact. Data preservation is as critical as data. Hundreds of electronic files change or are overwritten when a computer is simply turned on. Electronic data—including user-created files, RAM memory, internet history, and network logs—is inherently delicate and can be easily modified through the course of business. Proper data preservation practices enable you to capture fragile electronic evidence and, if necessary, obtain a forensic image or “snapshot” for further forensic data analysis. Failure to adhere to strict industry data preservation and collection standards may result in the altering or loss of critical data, exposing you to possible sanctions for