SLAMorris Final Thesis After Corrections.pdf - Cranfield University

analyse human behaviour, it can still have an influence over the evidence found
and presented in court. This influence can be divided into the actions of three
groups; the defendant, the analysts and legal personnel.
A wide variety of crimes can be committed which may involve computer based
evidence [Bainbridge, 2007], it is therefore important to understand the crimes
being investigated to ensure appropriate evidence is reported should it be
found.
Any action on a computer leaves a trace; the amount and location of that
information varies, and the average user is not aware of how to find and remove
such traces. As with any subject, there is a wide range of ability in computer
use, Smith [2008] looks at seven of the common misconceptions in computing,
of particular interest is the notion that files are deleted once placed in the
recycle bin.
The reason why a crime is committed is as individual as the person committing
it; however the underlying motivations are generally similar [Dreyfus, 1998]. An
in-depth discussion of criminal reasoning is beyond the scope of this research;
however the varying ability of the defendant to manipulate technology in order
to commit a crime is an important consideration. Having anti-forensic tools on a
user’s system may hold significant weight in an investigation as it may show an
intent to obfuscate information.
The use of Anti-forensic techniques is increasing [Forte, 2006], these generally
involve: zero foot printing, data obfuscation, and data hiding. Tools for antiforensic
practices can be found on the internet along with instructions for their
use; however the effectiveness of such tools varies greatly. Lio [2006] identified
4 main goals of anti-forensics, of which the primary aim is to avoid prosecution
Page 56