Forensics
How Computer Forensics Works by Jonathan Strickland
Computer Image Gallery
Paul Howell/Getty Images Imagine how many files were retrieved from these computers on Enron 's trading floor. See more computer pictures.
When the company Enron declared bankruptcy in December 2001, hundreds of employees were left jobless while some executives seemed to benefit from the company 's collapse. The United States Congress decided to investigate after hearing allegations of corporate misconduct. Much of Congress ' investigation relied on computer files as evidence. A specialized detective force began to search through hundreds of Enron employee computers using computer forensics.
The purpose of computer forensics techniques is to search, preserve and analyze information on computer systems to find potential evidence for a trial. Many of the techniques detectives use in crime scene investigations have digital counterparts, but there are also some unique aspects to computer investigations.
For example, just opening a computer file changes the file -- the computer records the time and date it was accessed on the file itself. If detectives seize a computer and then start opening files, there 's no way to tell for sure that they didn 't change anything. Lawyers can contest the validity of the evidence when the case goes to court.
Some people say that using digital information as evidence is a bad idea. If it 's easy to change computer data, how can it be used as reliable evidence? Many countries allow computer evidence in trials, but that could change if digital evidence proves untrustworthy in future cases.
Computers are getting more powerful, so the field of computer forensics must constantly evolve. In the early days of computers, it was possible for a single detective to sort through files because storage capacity was so low. Today, with hard drives capable of holding gigabytes and even terabytes of data, that 's a daunting task. Detectives must discover new ways to
Computer Image Gallery
Paul Howell/Getty Images Imagine how many files were retrieved from these computers on Enron 's trading floor. See more computer pictures.
When the company Enron declared bankruptcy in December 2001, hundreds of employees were left jobless while some executives seemed to benefit from the company 's collapse. The United States Congress decided to investigate after hearing allegations of corporate misconduct. Much of Congress ' investigation relied on computer files as evidence. A specialized detective force began to search through hundreds of Enron employee computers using computer forensics.
The purpose of computer forensics techniques is to search, preserve and analyze information on computer systems to find potential evidence for a trial. Many of the techniques detectives use in crime scene investigations have digital counterparts, but there are also some unique aspects to computer investigations.
For example, just opening a computer file changes the file -- the computer records the time and date it was accessed on the file itself. If detectives seize a computer and then start opening files, there 's no way to tell for sure that they didn 't change anything. Lawyers can contest the validity of the evidence when the case goes to court.
Some people say that using digital information as evidence is a bad idea. If it 's easy to change computer data, how can it be used as reliable evidence? Many countries allow computer evidence in trials, but that could change if digital evidence proves untrustworthy in future cases.
Computers are getting more powerful, so the field of computer forensics must constantly evolve. In the early days of computers, it was possible for a single detective to sort through files because storage capacity was so low. Today, with hard drives capable of holding gigabytes and even terabytes of data, that 's a daunting task. Detectives must discover new ways to
Links: Fitzgerald, Thomas J. "Deleted But Not Gone." The New York Times. November 3, 2005. http://www.nytimes.com/2005/11/03/technology/circuits/03basics.htmlex=1288674000&en=52520fd64c31403f&ei=5090&partner=rssuserland&emc=rss Kerr, Orin S Harris, Ryan. "Arriving at an anti-forensics consensus." Digital Investigation. 2006. http://dfrws.org/2006/proceedings/6-Harris.pdf "How the FBI Investigates Computer Crime." CERT Witter, Franklin. "Legal Aspects of Collecting and Preserving Computer Forensic Evidence." Global Information Assurance Certification. April 20, 2001. http://www.giac.org/certified_professionals/practicals/gsec/0636.php