Encyclopedia of Computer Science and Technology

102 computer forensicsa device processes input data or commands, the applicablestandards must be met. Finally, cost is always an issue.Moving beyond hardware to operating system (OS)design, computer engineers must deal with many additionalquestions, including the file system, how the OS will communicatewith devices (or device drivers), and how applicationswill obtain data from the OS (such as the contents ofinput buffers). Today’s operating systems include hundredsof system functions. Since the 1980s, the provision of allthe objects needed for a standard user interface (such aswindows, menus, and dialog boxes) has been consideredto be part of the OS design. Finally, the building of securityfeatures into both hardware and operating systems hasbecome an integral part of computer engineering (see, forexample, biometrics and encryption).TrendsIn the early days of mainframe computing (and again atthe beginning of microcomputing) many distinctive systemarchitectures entered the market in rapid succession. Forexample, the Apple II (1977), IBM PC (1981), and AppleMacintosh (1984) (see ibm pc and Macintosh). Becausearchitectures are now so complex (and so much has beeninvested in legacy hardware and software), wholly newarchitectures seldom emerge today. Because of the complexityand cost involved in creating system architectures,development tends to be incremental, such as adding PCIcard slots to the IBM PC architecture while retaining olderISA slots, or replacing IDE controllers with EIDE.The growing emphasis on networks in general and theInternet in particular has probably diverted some effort andresources from the design of stand-alone PCs to networkand telecommunications engineering. At the same time,new categories of personal computing devices have emergedover the years, including the suitcase-size “transportable”PC, the laptop, the book-sized notebook PC, the handheldPDA (personal digital assistant), as well as network-orientedPCs and “appliances.” (See portable computers andsmartphone.)As computing capabilities are built into more traditionaldevices (ranging from cars to home entertainment centers),computer engineering has increasingly overlapped otherfields of engineering and design. This often means thinkingof devices in nontraditional ways: a car that is able to plantravel, for example, or a microwave that can keep track ofnutritional information as it prepares food (see embeddedsystem). The computer engineer must consider not only therequired functionality but the way the user will access thefunctions (see user interface).Further ReadingIEEE Computer Society. Available online. URL: http://www.computer.orgPatterson, D. A. and J. L. Hennessy. Computer Organization andDesign. 3rd ed. San Francisco: Morgan Kaufmann, 2004.“PC Guide.” Available online. URL: www.pcguide.com. AccessedJune 18, 2007.Stokes, John. Inside the Machine: An Illustrated Introduction toMicroprocessors and Computer Architecture. San Francisco: NoStarch Press, 2007.computer forensicsComputer forensics is the process of uncovering, documenting,analyzing, and preserving criminal evidence thathas been stored on (or created using) a computer system.(For the use of computers by police, see law enforcementand computers.)In general, computer forensics involves both adherenceto legal evidentiary standards and the use of sophisticatedtechnical tools. The legal standards requirepractices similar to those used in obtaining other typesof criminal evidence (observing expectations of privacy,knowing when a warrant is needed to search and seizeevidence, and so on).Once there is a go-ahead for a search, the first step is todocument the layout and nature of the equipment (generallyby photographing it) and to identify both devices thatmight be problematic or notes or other materials that mightreveal passwords for encrypted data.If the system is running it may be viewed or scanned todetermine what applications are running and what networkconnections may be active. However, this has to be done asunobtrusively as possible, since some machines can detectphysical intrusions.Step by step, the forensic technician must documenteach software program or other tool used, and why it isjustified (such as the possibility that simply shutting downthe system might lead to loss of data in RAM). There are avariety of such tools, particularly for UNIX/Linux environments,some of which have been ported to Windows. (Insome cases a Linux “live” CD might be booted and used toexplore a Windows file system.)The next step is to collect the evidence from storagemedia in such a way as to ensure that it is accurately andcompletely preserved. A running machine must generallyfirst be shut down in such a way as to prevent triggeringany “trip wire” or intrusion-detection or self-destructmechanism that may have been installed.As a practical matter, once the system has been properlyshut down or immobilized, it is usually taken to the forensiclaboratory for extraction, copying, and documenting ofthe evidence (such as files on a hard drive or other storagedevice).Once the data has been collected, each file or documentmust be analyzed to determine if it is relevant to the criminalinvestigation and what key information it contains. Forexample, e-mail headers may be analyzed to determine thesource and routing of the message.Some Typical CasesComputer-based evidence may be relevant for almost anytype of crime, but certain kinds of crimes are more likely toinvolve computer forensics. These include:• financial crimes, such as embezzlement• corporate crimes such as insider trading, where e-mails may reveal who knew what and when• data or identity theft, including online scams orphishing