Digital Forensics

Digital forensics, sometimes known as digital forensic science is a branch of computer forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer cyber crime. Information and Communications Technology (ICT) working environments are experiencing increased computer use for other than work-related reasons. User activities may include but are not limited to browsing the Internet for private purposes and using online search engines for work-related information.
As ICT has grown at the same time advances in social networking, mobile technology, cloud computing and storage solutions have increased the information flow within organizations. This has weakened the security of organizational

This has demanded to increase in computer security mechanisms in an effort to control such activities and a growing need for forensic tools to gather accurate digital evidence [6]. Beebe [7] submits a lack in digital forensic standardization and process, which is resulting in limited prosecution and not acceptable in court of

Committees such as the Digital Forensic Research Workshop Group (DFRWS) [10] and the American Society of Digital Forensics and e Discovery (ASDFED) [11] have proposed processes to be followed in the collection of digital evidence. From the above it follows that there is no standard forensic process in place to be followed by digital forensic investigators. It would be a serious mistake for a forensic investigator to ignore the procedure of evidence collection in cases where the evidence aids in proving the case and leaves no doubt in the minds of those having to decide on the matter. Where evidence is presented without proof of thorough procedure, the defense may question the forensic procedure followed to collect the digital evidence. The famous American court case of Simpson is an example where the forensic process was scrutinized by the defense [12]. In this case the crime scene evidence was collected, but a robust evidence collection process was not followed. Because of this the evidence was invalidated by the defense. Tools such as Encase have been accepted as a reliable solution in computer crime investigations [13]. Both the process followed when using Encase and the resulting digital evidence are accepted as reliable. Other tools have also been used successfully, such as FTK [14] and SleuthKit [15]. Some are commercially available and others are open source. Many of these tools