SLAMorris Final Thesis After Corrections.pdf - Cranfield University

The definition of Forensic Computing has been the subject of debate; Hall
[2005] compared a variety of definitions that are in use; for example Garber
[2001] describes the subject as:
“the analysis of hard drives, CDs, floppy disks, zip and jazz disks, flash memory
cards and other forms of storage media to uncover evidence of crimes”.
One of the most common aspects identified throughout the definitions Hall
examined is the requirement to ensure the preservation of both the physical and
digital evidence [Hall, 2005]. Forensic Computing has been shown to have
different professional and academic concerns to those found in computer
science [Cooper, 2005]; the field has more similarities with the professional and
academic concerns of Forensic Science. Whilst there are many definitions
available for Forensic Computing, it can still be defined as a sub-discipline of
forensic science [Hall, 2005]. The Oxford English Dictionary [OED, 2011]
defines forensic as “relating to or denoting the application of scientific methods
and techniques to the investigation of crime”; therefore Forensic Computing
could be considered to be the application of the principles of forensic science to
digital devices.
The investigatory process aims to prove or disprove a hypothesis, using
methods which can be presented in court; the hypothesis generally relates to
the actions of an individual. An analyst needs to handle the digital media in a
suitable way to ensure this objective is fulfilled. The focus of forensic computing
is to investigate an event after it has occurred through acquiring, analysing and
reporting any evidence recovered from digital media [Hannan, 2004].
McKemmish [1999] identified four key components of forensic computing in
terms of their involvement with digital evidence. These are: (i) identification, (ii)
preservation, (iii) analysis and (iv) presentation; each component having its own
procedures and requirements.
Page 12