P-MART wiki - User contributions [en]

User:ArrudaBowie326

2012-06-06T17:21:35Z

ArrudaBowie326: Created page with 'Introduction Computer forensics will be the practice of collecting, analysing and reporting on digital data in a way that is legally admissible. It is often employed at the detec…'

Introduction
Computer forensics will be the practice of collecting, analysing and reporting on digital data in a way that is legally admissible. It is often employed at the detection and prevention of crime and in any dispute where evidence is stored digitally. Computer forensics has similar examination stages to other forensic disciplines and faces identical issues.

About this guide
This guide discusses laptop forensics from a neutral perspective. It isn't linked to particular legislation or intended to promote a certain home business or item and is not written in bias of either law enforcement or commercial pc forensics. It is aimed at a non-technical audience and gives a high-level view of computer system forensics. This guide makes use of the term "computer", nonetheless the concepts apply to any device capable of storing digital information. Where methodologies have been mentioned they are provided as examples only and do not constitute tips and hints or guidance. Copying and publishing the whole or portion of this article is licensed solely below the terms of the Creative Commons - Attribution Non-Commercial 0 license

Uses of personal computer forensics
There are couple of areas of crime or dispute where personal computer forensics can't be employed. Law enforcement agencies have been among the earliest and heaviest users of pc forensics and consequently have often been at the forefront of developments in the field. Computers might constitute a 'scene of a crime', for instance with hacking [ one] or denial of service attacks or they may well hold evidence at the style of emails, on the internet history, documents or other files relevant to crimes including murder, kidnap, fraud and drug trafficking. It isn't basically the content of emails, documents as well as other files which could be of interest to investigators but as well the 'meta-data' associated with those files. A pc forensic examination may reveal once a document 1st appeared on a computer system, once it was last edited, as soon as it was last saved or printed and which user completed these actions.

Guidelines
For evidence to be admissible it must be dependable and not prejudicial, meaning that at all stages of this procedure admissibility have to be at the forefront of a laptop or computer forensic examiner's mind. One set of hints which has been widely accepted to assist in this will be the Association of Chief Police Officers Good Practice Guide for Computer Based Electronic Evidence or ACPO Guide for brief. Although the ACPO Guide is aimed at United Kingdom law enforcement its major principles are applicable to all laptop forensics in whatever legislature. The four main principles from this guide have been reproduced below (with references to law enforcement removed):

No action ought to alter information held on a laptop or storage media which is usually therefore relied upon in court.

In instances where a person finds it essential to access original information held on a pc or storage media, that person must be competent to do so and be able to provide evidence explaining the relevance as well as the implications of their actions.

ArrudaBowie326

2012-06-06T17:21:32Z