Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
comprise only .003% of the total. Magnetic storage is by far the largest medium for storing
information and is the most rapidly growing, with shipped hard drive capacity doubling every
year.
Single hard drives now hold a gigabyte of data and sell for less than forty cents per gigabyte, a
two-thousand-fold price drop in just a few years time. By way of comparison, if the automobile
industry were as efficient, you could buy a new car for less than you paid for your last haircut!
Computer Forensics
Computer forensics is the identification, preservation, extraction, interpretation and presentation
of computer-related evidence. It sounds like something anyone who knows his way around a
computer might be able to do, and in fact, many who offer their services as computer forensic
specialists have no formal forensic training or certification--which is not to say they can’t do the
job well, but it certainly makes it hard to be confident they can! There are compelling reasons to
hire a formally trained and experienced computer forensic specialist. Far more information is
retained by a computer than most people realize, and without using the right tools and
techniques to preserve, examine and extract data, you run the risk of losing something
important, rendering what you do find inadmissible, or even being charged with spoliation of the
evidence.
The cardinal rules of computer forensics can be expressed as the five As:
1. Admissibility must guide actions: document everything that is done;
2. Acquire the evidence without altering or damaging the original;
3. Authenticate your copy to be certain it is identical to the source data;
4. Analyze the data while retaining its integrity; and,
5. Anticipate the unexpected.
These cardinal rules are designed to facilitate a forensically sound examination of computer
media and enable a forensic examiner to testify in court as to their handling of a particular piece
of evidence. A forensically sound examination is conducted under controlled conditions, such
that it is fully documented, replicable and verifiable. A forensically sound methodology changes
no data on the original evidence, preserving it in pristine condition. The results must be
replicable such that any qualified expert who completes an examination of the media employing
the same tools and methods employed will secure the same results.
After reading this paper, you may know enough of the basics of computer forensics to conduct a
rudimentary investigation; but recognize that conducting a computer forensic investigation
without the assistance of a qualified expert is a terrible idea. Experiment on an old system if
you’d like, but leave real evidence to the experts.
Computer forensics focuses on three categories of data:
Page 9