Topics: computer forensics, forensic imaging, disc imaging, computer-based evidence, image verification
The investigation of crimes involving computers is not a simple process. In the vast majority of cases, the assistance of a computer forensic expert is required to extract information for an electronic device without corrupting or contaminating the original data, which could render any evidence recovered inadmissible in a court of law.
The requirement for an auditable approach to the analysis of digital data is set out by the Association of Police Officers (ACPO) guidelines for the handling of computer-based evidence. These guidelines outline rules for every step of the process - from crime scene and seizure protocol through to analysis, storage and reporting - to ensure evidential continuity and integrity.
Because the preservation of evidence in its original state is so vital, computer forensic experts use a process known as forensic disc imaging, or forensic imaging, which involves creating an exact copy of the computer hard drive in question. This is not a case of copying files from one drive to another, rather it is the process of copying the exact state of every piece of data of the drive, so that artefacts such as registry entries - which record information pertaining to activities performed on the computer such as a connection and disconnection of an external storage device - and even apparently ‘deleted’ files are copied exactly to the new image.
Creating a perfect forensic image of a hard drive can be very time consuming and the greater storage capacity of the drive, the greater the time required. The method used to extract the data is also a factor, so with a ‘FireWire’ connection, imaging may occur at a rate of approximately 1 gigabit (GB) per minute, but using specialist hardware, this rate could rise to an average of 4GB per minute. This means that imaging a 1 terabyte (TB) drive, currently available for purchase for less than 80 GBP, would take around five to 18 hours to complete.
However, copying the data is only half of the imaging procedure, the second part of the process is to verify the integrity of the copy and to confirm that it is an exact duplicate of the original. Image verification takes a similar amount of time to imaging, effectively doubling the time taken to complete the imaging process. And if any inconsistencies are located, the process must begin again from scratch, meaning that a failed first attempt at imaging a 1TB drive would mean that the full imaging and verification process could take 20 to 72 hours to complete.
While forensic imaging is a vital process to ensure that evidential continuity and integrity is preserved, the time consuming nature of the process can put investigations under pressure, particularly in cases of kidnap or terrorism where a delay in recovering evidence could have disastrous consequences. And this is a problem that seems unlikely to be solved in the short term, because as new technologies are developed to increase the speed with which a drive can be imaged, so too grows the storage capacity available to the average consumer.
IntaForensics a BS EN ISO 9001:2000 registered firm providing Computer Forensics, Expert Witness, Mobile Phone Forensics, and Forensic Data Recovery to the Legal Sector, Police Forces, Local Authorities and Commercial organisations internationally. Visit www.intaforensics.com.
Previous Articles Highlighter:
Website Design Guidelines For Forms - Preventing Lost Conversions (1)
It is this mix of technical savvy and understanding the customer's point of view that will help your forms convert optimally. InetAsia Solutions is a new breed of internet marketing consultancy.Check out our website to find out more about search engine optimization and much more.For more information,please visit www.inetasia.com.
Why Business Should Have Disaster Recovery Solution Plans In Place (2)
A good example of this is a web hosting company with servers locate on site. An assessment of the effects of earthquake as against power outage is likely to show that the earthquake will be ranked fairly low compared to the power outage.
Removing Spyware Problems - Freeware Programs (3)
These are commonly irritating advertising tactics. Spyware are usually packed as an unknown component of shareware or freeware programs that can be installed or downloaded from the Internet. However, it must be noted that most of these freeware and shareware applications do not come with spyware.
Internet Marketing Success - Laying The Groundwork For Great Landing Pages (4)
Website design, and its associated internet marketing aims, is no different to any other business activity - groundwork is critical. Before undertaking search engine marketing campaigns, viral marketing or link building, internet consulting experts will tell you to start at the start!
Tips On Selecting Securing Payment Gateway Services (5)
Topics: payment gateway, online payment, merchant account, accept credit card If you are thinking of getting online to make some money, or putting website online that will generate income and earn some money for you, then you need to know that unless you already have a merchant account, you cannot receive any payments online.
How Do I Reduce My Electric Bill For Free? - 4 Practical Tips You Should Start Doing Now (6)
- For those of you who are on a diet and following a strict weight loss plan, "cleaning" here does not refer to the inside of the fridge. You would want to make sure that you adopt a routine of cleaning under your refrigerator and along with that, the coils on the backside.
Why Electrical Estimating Software Is A Must (7)
by hand. It simply is not feasible in most contexts and does not appear professional. As in just about every other area, a computer is the most important tool a contractor can have, and having the right electrical estimating software is essential to not only getting the job, but doing the job right.
How Visitors Experience Landing Page Website Design (8)
Don't include 'Clear Form' buttons, as if these are mistakenly clicked instead of the Submit button, your prospect simply may not bother filling in all of the information again. Ensure you have an email privacy statement, and give alternative forms of contact with your business for best results.
Some Of The Basics Of Rubber Keypad Technology (9)
Today's rubber keypads must be strong enough to withstand near constant wear and tear while still retaining the tactile control that makes them so desirable. The switch design for most rubber keypads is universal: what changes is the type of covering placed over the switch.
How To Upgrade Your Computer's Video Card Driver (10)
Input your video card's information and follow the instructions to download the driver. Once you have agreed to download the driver, you will be prompted to save the file on your desktop.
Newer Articles Highlighter:
See A Little More Clearly With Night Vision Goggles (1)
Because of convenience, it is ideal to use for surveillance and observation. The story of law enforcers may have also convinced you that these devices are truly dependable when you need to see through the darkness and when you need speed and agility during emergencies.
Looking At Digital Photo Recovery (2)
Anytime that it appears you have lost your pictures, you can turn to software and professional recovery services to get your pictures backward. Your digital photographs are very important, which is why you'll hope to take care of them.
Finding The Best Photo Printer (3)
We're starting to see wireless printers hitting the market nowadays also in the use will allow you connect directly from your computer using the 802.11 wireless standard. Before you decide to to purchase and a photographic printer you need to make sure that you do your research before hand.
Get To Know More About A Night Vision Camera (4)
There are plenty of homes and offices that are using simply because the owners understand the advantages of having one in the area: 1. You can mount it. Unlike monoculars, binoculars, and goggles that have to be worn or supported by hand while you are using them, it can be mounted or installed in a covert area.
Where To Go For Data Recovery (5)
This way, tests can be run on it and the specialists there can recover your data, which may need rebuilding your difficult drive. If you happen to have multiple severe drives or a RAID configuration, then all you want to do is replace the broken difficult drive, and the data that you thought you lost will be regenerated among the other drives.
A Pen Drive Guide To Beginners (6)
Even one with the lowest capacity has plenty of space to store a huge amount of data. All common types of files can be transferred to a pen drive which can subsequently be transferred to any type of hard drive.
How To Extend The Life Of Your Night Vision Monocular (7)
Avoid using the night vision monocular during bad weather. Fog, mist, haze, rain, and other drastic weather conditions will only prevent you from seeing images clearly. 5. Buy it from a good store.
Different Ways To Connect To Your Printer (8)
All in all these are the ways to connect from your computer to your printer makes some sense. We're starting to see more common with FireWire connections now, which is increasing the speed from USB.
Anti-Spyware Kit - Spyware Blocker (9)
Scans the results of your search. It also places secure ratings beside each links. The program also scans every website that you plan to open just before you open it.
Recycling Your Cell Phone (10)
Recycling a cell phone is a smart choice that keeps the environment healthier and allows people who couldn't otherwise afford a phone to have one. If you're thinking about upgrading, or you need to buy a new phone because yours is broken, don't toss it in the trash.