Introduction
Forensics investigations that require the analyzation and processing of digital evidence can be influenced both positively and negatively by a number of outside sources. In this paper, we will explore how physical security plays a role in forensics investigations activities. We will start by examining how physical and environmental security might impact the forensics investigation process. Next, we will discuss the role that physical and logical security zones play in supporting effective forensics activities. We will illustrate how centralized and decentralized physical and environmental security affects the forensics professional’s approach toward the investigation. Lastly, we will evaluate some potential areas of risk related to the physical security of our case study organization, Widget Factory, identified in Attachment 1.
Physical and Environmental Security Impact on Forensics Investigations
Physical and environmental security programs are generally considered to be a collection of mechanisms and controls put into place that help ensure the availability of information technology capabilities. These programs protect an organization from fire, flood, theft, power failure, intentional, and even unintentional damage through negligence. Implementation of these programs at the organizational level can take place in a number of ways but most organizations choose to follow the application of a body of standards, usually set forth by an organization such as the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Once such body of standards put forth by ISO/IEC is 27002, Information technology – Security techniques – Code of practice for information secur...
... middle of paper ...
...al security factors make continued operations in these remote location extremely risky.
Summary
Physical security plays an important role in the digital forensics process. Implementation of a good physical and environmental security program can help digital forensics investigators perform their jobs more accurately and effectively. In this paper we explored just how those physical and environmental security programs impacted forensics activities. We explored the role of security zones including how the zones function together during the investigative process. Additionally, we showed how centralized and decentralized physical and environmental security impacts forensics evidence gathering. Finally, we evaluated some of the potential risks to physical security in our case study organization in an attempts to improve the security posture of that organization.
Digital Forensic is the process of uncovering and interpreting electronic data that can be used in a court of law. It requires a set of standards to show how the information that is gathered, preserve, and analyzed is strictly followed. The analysts need to understand the evolution of the current technology and how it will impact how they gather their information. The investigator is able to uncover evidence and analyze it to gain the understanding of the motives, crime, and the criminal’s identity to help solve the crime. As computers and technology continue to become a part of our everyday lives, the cyber realm contains a growing realm for evince in all types of criminal investigations (Cummings, 2008) Digital forensics is a way to connect information security and law enforcement. It ensures that the digital evidence is collected in a way that it can make it into the courts in an unhampered or uncontaminated way (Dlamini, M., Eloff, J. & Eloff, M., 2009).
National Institute of Standards and Technology (NIST): Risk Management Guide for Information Technology Systems. Special Publication 800-30, 2002.
The information gathered in this report will show the methodology and tools used to forensically examine any files or images stored in relation to the investigation claim of Bobby Joe. While the examination is being conducted I will show how the chain of custody of evidence is kept, what evidence was discovered in the file image, and identify and examine the devices used. It will also show what steps Bobby Joe took to store information on the claim against him. The results of this investigation will then be used to determine if any offences he may have committed according to the State laws. The report will also provide a summary of the information for a jury to examine and understand. USB flash drive without any security function causes
Rape, murder, theft, and other crimes almost always leave a devastating mark on the victim. More often than not, it would be impossible to identify the perpetrator a crime without forensic science and the technology it uses. Forensic science allows investigators to unmask the secrets of the crime scene. Evidence gathered at the crime scene helps to identify the guilty party, murder weapon, and even the identity of the victim (Harkawy, 1991: 276). The new technologies enables the forensic experts to have better and faster access to accumulated information, to be more accurate in the identification of victims or delinquents, and minimizes the possibility of wrongful accusations. New technology has improved the methods and techniques that forensic scientists and law enforcement investigators use, in order to provide a safer environment for other people. Information technology is one of the most important aspects in forensic science. It is very important for the forensic experts to receive the undisturbed evidence, such as fingerprints left at the crime scene, as quickly as possible, for more accurate readings. Thus using space technology, such as satellite communication, enables the forensic experts to "gather and digitize evidence at the crime scene, enter it into an on-site computer, and beam the data to a crime lab for swift analysis" (Paula, 1998: 12). Therefore, due to the use of this technology, forensic experts in laboratories can examine the evidence in short time, and the possibility of damage or unlawful manipulation of the evidence before the trial is minimal (Paula, 1998: 12). More often than not, "criminals" wear gloves at the time of the crime, thus to obtain a fingerprint...
Robert Moore’s Cybercrime: Investigating High-Technology Computer Crime is an informative text that supplies the reader with basic understandable knowledge of increasing cybercrimes and strategies that law enforcement are taking in order to catch cyber criminals. Moore’s work has a total of thirteen chapters that are full of information that help the reader better understand the different cybercrime threats such as, hacking, identity theft, child pornography, and financial fraud. Moore also goes into detail on different law enforcement tactics that help catch cyber criminals such as, the seizing of digital evidence, executing search warrants for digital evidence, computer forensics, and cybercriminology. Moore’s main goal is to help the reader grasp a better understanding of cybercrime that faces the world today. Through reading this book, I can validly say that Moore’s thorough work, perspectives, and examples helped me better understand high-technology computer crime and investigative strategies as well.
Despite these advantages, Grispos, Glisson and Storer (2012) highlighted several challenges that the cloud environment may pose for digital forensic investigators during the collection and analysis phrases of the investigation process. Artifacts, data used that can be used as evidence, are often hard to extract because resources can be redirected and/or disappear destroying the trial of evidence in the process. During the preparation stage of the investigation, an investigator trained in the conventional methods of digital forensics will usually obtain a comprehensive history and overview of the crime scene, and have a idea of what will be required from the organization in order to proceed with the investigation. However, in the case of network forensic investigations, there is a no comprehensive history and overview of the suspected crime scene, and there is a lack of structured environment in which data transmissions between various network points and platforms can be collected as evidence. There may also be a lack of structure in the target environment and methods of monitoring and reporting transmission information may not exist. The segregation of duties and differences in the service models that exists between cloud service providers and cus...
Security helps the organization meet its business objectives or mission by protecting its physical and financial resources, reputation, legal position, employees, and other tangible and intangible assets through the selection and application of appropriate safeguards. Businesses should establish roles and responsibilities of all personnel and staff members. However, a Chief Information Officer should be appointed to direct an organization’s day to day management of information assets. Supporting roles are performed by the service providers and include systems operations, whose personnel design and operate the computer systems. Each team member must be held accountable in ensuring all of the rules and policies are being followed, as well as, understanding their roles, responsibilities and functions. Organizations information processing systems are vulnerable to many threats that can inflict various types of damage that can result in significant losses (Harris, 2014). Losses can come from actions from trusted employees that defraud the system, outside hackers, or from careless data entry. The major threat to information protection is error and omissions that data entry personnel, users, system operators and programmers make. To better protect business information resources, organizations should conduct a risk analysis to see what
Evaluation of the forensic tools identified UFED Physical Analyzer as the ideal choice. A cost-benefit analysis between the two tools and UFED had favorable results by mitigating the cost of training. Furthermore, extensive testing by the author and software tests performed by the U.S. Department of Homeland Security’s (DHS) Computer Forensics Tool Testing (CFTT) program determined UFED supports more mobile devices without reporting errors. In addition, the most important feature a mobile forensics tool has is the ability to retain integrity. This is especially true if a criminal case used the mobile device as evidence. UFED has been found to do this extremely well, where OFS falls short due to installing a program on the original device.
No matter what the case, forensic science has monumentally changed criminal investigation. From computer technology to fingerprint analysis, forensic science has played a key role in thousands of cases. The partnership between the law and forensic sciences has changed the justice system like no other investigative tool: the intelligence provided by this technology is instrumental for both exonerations and convictions alike.
On 5 October 2009, computer equipment from a network data closet was stolen from BCBST. The items stolen were 57 unencrypted hard drives which contained over 300,000 video recording and over one million audio recordings. According to Whitman & Mattord (2010), confidentiality, integrity, and availability makes up the C.I.A triangle which is the basis of Committee on National Security model for information security, an industrial standard, (Whitman & Mattord, 2010). Confidentiality can be a synonym for encryption but also means only the people with the correct permission can access the information. One of the major security issue is the hard drives were not encrypted. The hard drives should be encrypted to prevent people from reading the information the computer. Software can be purchased which will encrypt files on hard drive with such as Folder Lock, SensiGuard, Secure IT, and more. There are open source encrypting software which are free for use which could have been used. If the hard drives were not needed, the data should hav...
Live acquisition: The future of data acquisitions is shifting toward live acquisitions because of the use of disk encryption with newer operating systems (OSs). In addition to encryption concerns, collecting any data that’s active in a suspect’s computer RAM is becoming more important to digital investigations. The processes and data integrity requirements for static and live acquisitions are the same. The only shortcoming with live acquisitions is not being able to perform repeatable processes, which are critical for collecting digital evidence.
Forensic Science, recognized as Forensics, is the solicitation of science to law to understand evidences for crime investigation. Forensic scientists are investigators that collect evidences at the crime scene and analyse it uses technology to reveal scientific evidence in a range of fields. Physical evidence are included things that can be seen, whether with the naked eye or through the use of magnification or other analytical tools. Some of this evidence is categorized as impression evidence2.In this report I’ll determine the areas of forensic science that are relevant to particular investigation and setting out in what method the forensic science procedures I have recognized that would be useful for the particular crime scene.
The use of digital evidence found in mobile phones and emails are now being used in traditional crime investigation and prosecution. The United Kingdom Police and Criminal Evidence Code (currently reviewed by the (Serious Organised Crime and Police Act 2005) defines digital evidence as “all information contained in a computer”. The definition of computer here covers broad spectrum electronic appliances. A definition of Computer in the 2002 Commonwealth Model Law on Computer and Computer-related Crime defines a “Computer system” as a device or a group of inter-connected or related devices, including the Internet, one or more of which, pursuant to a program, performs automatic processing of data or any other
The transitional growth in the forensic science sector has not been without challenges. Though the world has experienced increased capabilities and scientific knowledge, which has led to faster investigations and results, many forensic experts have argued that forensic laboratory testing, in the light of 21st century technological advancements, is yet to meet the expected rate in quick available testing and analysis (Mennell & Shaw, 2006). This is with respect to the growing rate of crime and the high demand of quick crime scene testing and analysis. In the science of crime scene, analysis and interpretation of evidence is majorly dependent on forensic science, highlighting the change in the role of forensic sciences (Tjin-A-Tsoi, 2013). In the business of forensic science, time is beginning to play important role in the evidence testing and analysis which is becoming crucial in reducing ...
Forensic science has now been recognized as an important part of the law enforcement team to help solve crimes and cold cases. The advances in technology are being used each day and we must continue to strive to develop better advances in this field. The recent discovery of using DNA in criminal cases has helped not only positively identify the suspect, but it has helped exonerate hundreds of innocent individuals. “With new advances in police technology and computer science, crime scene investigation and forensic science will only become more precise as we head into the future.” (Roufa, 2017) Forensic science and evidence helps law enforcement officials solve crimes through the collection, preservation and analysis of evidence. By having a mobile crime laboratory, the scene gets processed quicker and more efficiently. Forensic science will only grow in the future to be a benefit for the criminal justice