Accepted guidelines for forensic analysis:
- A forensic examiner is impartial. Our job
is to analyze the media and report our findings with no presumption of
guilt or innocence.
- The media
used in forensic examinations must be sterilized (zeroed) before each
- A true
image (sector by sector) of the original media must be made and
used for the analysis.
- The integrity of the original media must be maintained throughout
the entire investigation.
that attorneys are not aware even exists is often found during this
process. Also, timelines of computer usage can help in crafting
deposition questions and in targeting witnesses for
typically 'delete' incriminating and/or sensitive computer files
information may still exist in slack space on the computer¬ís hard
drive. This computer data may linger for months or even years and
it can be recovered and documented using computer forensic methods and
times, computers are reissued when employees leave. Continued
use of the
computer may destroy the incriminating evidence that can be used against
a former disgruntled employee. Also, continued use of the computer may
raise questions as to who created the incriminating evidence and when.
To prevent these problems and to preserve potentially valuable
information, we recommend following a strict chain of custody and shut
down the subject computer.
We recommend that you DO NOT attempt to
search for the evidence yourself because this will change important
date/ time stamps as well as user information, thus, possibly
obstructing the investigation.
cases, verify the origin of E-mail and other types of computer
techniques employed by the sender to mask or hide who actually sent the
consultation and guidance for the generation of subpoenas for use in
compelling the production of relevant evidence by Internet Service
Providers that can be used to identify the person who sent the E-mail
primary job is to preserve the computer evidence and to transport the
computer to a safe location where a complete bit stream backup of all
stored data areas can be made. You also want to insure that the
computer system can be reconfigured to match the configuration in which it was
found. For this purpose, it is wise to take pictures of the complete
computer system from all angles. Wires should be marked such that they
can be easily reconnected. Also, the computer should be clearly marked
as evidence and stored out of reach of inquiring co-workers. Chain of
custody is as relevant when it comes to computers as any other form of
Law enforcement agencies have come under scrutiny regarding
For this reason, it is important for the computer investigator to
document everything, as they will be testifying in court.
Every effort must be made to show that no
one could have made changes to the information contained on a
computer system. Without such
assurances, countless hours of processing effort may prove to be wasted
time and the case may be lost at trial.