Cyber Forensics

Introduction

What is Cyber Forensics?

“Computer forensics, also called cyberforensics, is the application of computer investigation and analysis techniques to gather evidence suitable for presentation in a court of law. The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computer and who was responsible for it” (Techtarget, 2004).

As mentioned above cyber forensics is a complex task. It involves using various tools in gathering evidence. Just like in a murder crime scene investigation, investigators find for evidence, such as fingerprints, hair, gunshot residue and others. In Cyber Forensics, investigators look out for digital evidences such as encrypted files, deleted files, e-mail artifacts, instant messaging artifacts and others. The evidence collected will be analyzed and presented in a court of law.

In this research based essay we will be looking at various aspects of Cyber Forensics.

Aspects such as:

• Digital evidence

• Key principles of Cyber Forensics

• Threats to data held on computers

• Investigation processes

o Preservation of digital evidence

o Locating of digital evidence

o Selecting digital evidence

o Analyzing digital evidence

o Validating digital evidence

o Presenting digital evidence

• Investigation techniques using simple forensic tools

• Crime reconstruction hypotheses and alternative hypotheses

Digital evidence

What is Digital Evidence?

“Digital Evidence: Encompasses any and all digital data that can establish that a crime has been committed or can provide a link between a crime and its victim or a crime and its perpetrator.”(Casey, 2004).

Digital evidence involves the use of computer technology and comes in various forms. “It includes all facets of crime where evidence may be found...