SLAMorris Final Thesis After Corrections.pdf - Cranfield University

2.2.3 Current Opportunities
Forensic computing is a relatively new field which is growing at a fast pace and
encompasses a wide range of devices. This rapid growth is due to society's
expanding development and use of technology; each technology has the
potential for misuse and may therefore be the subject of an investigation. In this
section the opportunities that have been created for forensic computing
research will be discussed.
The increased use of storage media may provide a greater chance of
recovering information for a case. However It is impractical, given the limited
time, equipment and financial resources forensic analysts have available, to
analyse every cluster of a large storage device by hand [Hama, 1996].This can
result in information not being found particularly if it resides in partial fragments
of unallocated space. The use of multi partition systems or RAID drives does
not impact on the ability to identify information in unallocated space; the impact
on identifying information relates to whether the file is compressed or encrypted.
Any fragment which is part of a file structure which is uncompressed and
unencrypted may be identified by an analyst using standard identification
techniques discussed in Chapter 7.Therefore a current opportunity for research
is to create methods to automate the retrieval of information; this enables
resources to be maximised and to reduce the information that an analyst must
initially review by hand.
With the use of the internet, network storage and portable media, evidence of a
crime could be present in multiple locations across the globe [Berinato, 2007].
The distribution of data can cause problems in collecting and analysing
evidence as it may be difficult to retrieve evidence from media in a different
geographical location. The media may be in an unknown location or not even
known to exist. Whilst it is impractical to retrieve all distributed data, the ability
to show relationships between the main device and devices used in conjunction
Page 20