Computer Forensics

Evidence What does a computer forensic analyst do? What is the importance of knowing how a computer can hide and even give answers to solve a crime? These are the things that are asked when you start to learn about a computer forensic. There are a lot of things that comes with being a computer forensic, you have to know about write blocking, bit-by-bit or bit stream copy, hashing or also called hash values, indexing process, recovering deleted and encrypted files. What makes this all important to a forensic analysis? Knowing the inside and out of a computer is not the only thing that you have to worry about when you become a computer forensic analysis. A forensic analysis is the process by which a forensic examiner captures, clones, reveres, and analysis data from a

(Knetzger & Muraski, 2008, p. 343). So now you know what you have to do when becoming a forensics analysis let’s get into the details or the specifics of what your job will consist of.
Now a write blocker is a device that is installed on the suspect’s hard drive or other media that completely prevents the forensics examiner for writing ant data to the hard drive or media. It is simply makes it physically impossible by blocking the wires that could communicate the data to be written to the drive. (Knetzger & Muraski, 2008, p. 359). And once the write blocker is installed the forensic specialist will use a drive-imaging or cloning utilities to make an exact duplicate of the original suspect drive. This is called the bit-by-bit copy, because it takes makes copies by bit-by-bit. (Knetzger & Muraski, 2008, p. 336). Now hashing is a mathematical analysis of the data on the drive that generates a unique string of characters based upon the files and structure of the drive. Individual files can also be hashed to check for identical files, the standard hash utilized by most forensic software utilities called the Message Digest 5