COMPUTER FORENSICS AND DIGITAL CRIME

Computer Forensics And Digital Crime

Computer Forensics And Digital Crime

Introduction

This report will detail the requirements for investigation of suspected fraud by some employees. The chief information officer (CIO) Mr I. Knowsal has noticed that some records relating to particular orders appear to have been tampered with; amounts of many don?t tally with printouts and more goods have been ordered than was originally required but cannot be found in the warehouse. The CIO suspects the assistant imports manager Axta Grynd. Axta was very unhappy at being passed over for promotion to chief imports manager two years ago and had been threatening to sue of sex discrimination. Archie Rival, who got the job, says he is very happy with Axta?s work and doesn?t feel there is any conflict. However, at a recent annual review meeting the shipping clerk Asif Iwud told his reviewer in confidence that he believed Axta had not ?forgotten and forgiven but had other fish to fry?. He believes she will be resigning soon and is hoping to get her job.

The layout and contents of the offices are shown in the diagram above.

Evidence to be securedEvidence is the means and materials that enable a case to be proven. The evidence shows the actual events that took place in any situation, and evidence can either be Digital, Electronic or physical. Digital Evidence is the information that is transmitted or stored in computers in binary form, and which is admissible in a court of law. Electronic Evidence is evidence or data of investigative value which can be stored and transmitted by electronic devices.

Electronic Evidence: Legislative Considerations

Various jurisdictions allow for various principles concerning electronic evidence, but these principles are quite similar to the principles defined by the ACPO (Association of Chief Police Officers). 4 principles of digital and electronic evidence are defined in the third version of the Good Practice Guide for Computer Based Evidence, and these will be described here.

Securing Evidence: Forensic Guidelines

Whenever there is cause for computers to be confiscated for forensic examination, there are some pointers as regards the ACPO (Association of Chief Police Officers) Guide for Good Practice concerning digital and electronic evidence. The guidelines are basically for Police Officers in the United Kingdom, but it is good practice to follow these guidelines especially when there is need to seize and examine electronic data. It is also good practice to treat electronic data in the same manner as physical or traditional forensic evidence, and the ACPO guidelines are aimed at achieving the required standards. Also following these principles will ensure the integrity of the case and, ensure that the steps taken are in compliance with the law.

The guidelines include the following principles:

No action taken by Law Enforcement agencies or their agents should change data held on a computer or storage media, which may be relied upon in court. In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person MUST be competent to ...