Download - Foreign Military Studies Office - U.S. Army

and only if data suggests a crime, are law enforcement officials called. All of
these are realistic scenarios. Trained forensic examiners may acquire the data at
some point, or investigators may obtain enough evidence so that a forensic
examiner is never requested. The potential problem is that a standard technique
or tool is not utilized from this multitude of possibilities. One premise repeated
in professional books on computer forensics is to know your limitations and
call for help when your knowledge on a particular subject is exceeded. It is not
OK to assume or continue an examination if you do not know what you are
doing. Why a plethora of individuals to deal with digital information? The
most important reason is time. How long will that evidence be there? Will
seizing that computer by turning it off lose the critical data that the investigator
needs?
Some data will be in memory and will be lost if the system is shut
down or shut off for a bit-for-bit copy. This is called “volatile data.” This
information should be evaluated based on the case type, the computer or
network server to be analyzed, and the likelihood that volatile data exists. If so,
there are protocols developed to save this data. These protocols allow a copy of
the process table to be copied out to a file. The process should be followed, and
all steps, actions, and reasons for actions should be documented. Processes for
retrieving static data follow the law enforcement agency’s guidance or the
national standard for preserving static data.
While the proliferation of digital forensic practices and training in the
commercial as well as the law enforcement community is a fact, there is a down
side. The methods, techniques, and tools can become common knowledge.
When this happens, smart criminals create countermeasures to those methods.
For example, not many people initially realized that erasing a file on a
computer did not completely eliminate the data. Many criminals did not realize
this either much to their chagrin. Today many people know that deleting a file
does not fully remove it from the media. Tools have been developed that
completely remove a file. A product called “Evidence Eliminator” professes to
rid a Windows system of all traces of evidence.
Of the forensic processes used by law enforcement personnel, it is
important to note the following as the main processes of digital forensics.
Identifying the Data Properly
The agency investigating the incident will have strict procedures and
forms for this process. It is the typical police “bag and tag.” Taking digital
media into evidence is no different from any other type of evidence. It must be
brought into a “chain of custody.” When volatile information is captured and
318