Chapter 2 Understanding Computer Investigation.pdfVIP

Guide to Computer Guide to Computer Forensics and Forensics and Investigations, Investigations, Second Edition Second Edition Chapter 2 Understanding Computer Investigation Objectives Objectives ? Prepare a case ? Begin an investigation ? Understand computer forensics workstations and software ? Conduct an investigation ? Complete a case ? Critique a case Guide to Computer Forensics and Investigations, 2e 2 Preparing a Computer Investigation Preparing a Computer Investigation ? Role of computer forensics professional: gather evidence to prove a suspect committed a crime or violated a company policy ? Collect evidence that can be offered in court or at a corporate inquiry – Investigate the suspect’s computer – Preserve the evidence on a different computer Guide to Computer Forensics and Investigations, 2e 3 1 Preparing a Computer Investigation Preparing a Computer Investigation continued continued ? Follow an accepted procedure to prepare a case ? Chain of custody – Route the evidence takes from the time you find it until the case is closed or goes to court ? US DOJ Search and Seizure Guide /criminal/cybercrime/ssmanu al2002.pdf Guide to Computer Forensics and Investigations, 2e 4 Examining a Computer Crime Examining a Computer Crime ? Computers can contain information that helps law enforcement determine: – Chain of events leading to a crime – Evidence that can lead to a conviction ? Law enforcement officers should follow proper procedure when acquiring the evidence – Digital evidence can be easily altered by an overeager investigator Guide to Computer Forensics and Investigations, 2e 5 Examining a Computer Crime Examining a Computer Crime continued continued Guide to Computer Forensics and Investigations, 2e 6 2 Examining a Company Policy Violation Examining a Company Policy Violation ? Employees misusing resources can cost companies millions of dollars ? Misuse includes: – Surfing the Internet – Sending personal e-mails – Using company compu