A Primer On Computer Forensic Investigation

By Donald Davis


The techniques used to perpetuate crime by fraudsters and other criminals have morphed dramatically over the years. Today, computers are avenues through which criminals steal money from bank accounts, perpetuate identity theft and infiltrate private networks. Computer forensic investigation is more of a reactive step to these problems.

Till now, you may have thought that deleted data is rendered irretrievable every time you press delete on your PC. Many criminals think the same, with the thought of erased evidence driving them further to commit more crimes. What few people know is that it is not too hard to retrieve deleted data from a PC.

This is because upon deletion, data does not entirely get wiped out from memory. The delete key simply instructs the PC to free up the already occupied space. It does this by shifting the data to a hidden register in memory. This essentially means the deleted data can still be rebuilt using custom software and by following a set of instructions.

A forensic investigator is likely to spend most of his time poring over hard drives. This is the case especially for those working for the police. A hard drive obtained from the PC of a Fraudster can be a treasure trove of evidence that can help prosecute him and others in his network.

Contrary to popular belief, cyber crime does not solely revolve around fraud. Child pornography can also be viewed as crime. By uncovering what lies hidden in the memory of a PC, prosecution teams can piece together deleted evidence and use it to bring a perpetrator of child pornography to justice.

Forensic investigations are also very helpful when it comes to upholding financial transparency in corporate organizations. In some organizations, rogue employees usually tweak their accounting applications to make them report falsified tax returns. Such acts can be easily uncovered through company wide system audits.

In this case, auditing may simply be a matter of comparing original data with what is in the accounting software. In large companies, this often takes months due to the vast amounts of data to be retrieved and compared. This notwithstanding, the results can always be counted on for truthfulness.

IT professionals majoring in forensics often get called to appear as expert witnesses during court proceedings. This is because jurors usually require a detailed account of how a crime was committed before passing judgment. This field is promising for any individual who would love to venture into it.

One crime that is easy to solve through this sort of work is PC theft. Every PC has data that uniquely identifies it with a buyer. Stolen computers are usually resold with this data wiped out. Through data reconstruction, law enforcement authorities can easily tell whether a stolen PC belongs to the person who has been caught with it.

This field is quickly becoming the best arsenal that the police have in their fight against cyber crime. If you have a desire to become an investigator, you might want to take a technology related course such as computer science. A certificate in forensics may also come in handy.




About the Author: