Computer Forensics Explained
In today’s ever changing criminal world the use of computers for fraud and the pursuit of other crimes has increased to dramatic proportions. So much so that specialist departments have been formed to help deal with the problem of computer crime.
Computer crime is not only about fraud – online or otherwise – it also encompasses areas such as pornography, child sex abuse and the sale of black market goods online.
Pressing the Delete KeyOne of the most common mistakes made by many individuals committing computer crime is that which says pressing the delete key will get rid of any tell tale evidence; this is simply not the case. Information that has been removed by deletion has not been removed completely from the hard drive; the space has simply been freed up so that other information can be written over the top of it. This in effect means the original information is still there and can be retrieved by computer forensics officers using the correct software.
Re-Constituted Hard DrivesAnother element of the computer forensics’ department’s remit is the checking of all hard drives that are brought to them within personal computers and laptops. This can be useful in as much as many computers are stolen and are simply wiped clean only to be sold on. However because the knowledge of many thieves is limited all they are simply doing is writing over the computer’s original hard drive information which can – using what is known as an ‘image’ – be restored to its original condition thus providing valuable information as to the computer’s original owner.
The same ‘image’ principal applies to computers which are thought to have been used by individuals – or gangs – involved in child pornography or pornography in general. It is illegal in the United Kingdom to view pornography via the Internet although many people may find this a strange concept. In the United States the legal age is 21 but in the United Kingdom the activity is illegal which is why nearly all British owned pornographic websites are hosted from serves off shore.
Forensic AccountingThere are individuals who may – for the purposes of gaining money by deception or defrauding Her Majesty’s Revenue & Customs – alter their computerised accounting software to report figures that are not necessarily reflective of those which have been generated originally.
In this instance a forensic accounting specialist would reconstitute the computerised accounts to reflect the original copies that were originally kept on the hard drive or other media before being altered. This is a long and arduous process which can take many weeks or indeed months to complete but it is worth noting that in most cases there is a high degree of success and accuracy in the findings of the forensics departments.
Expert WitnessesForensic IT specialists are often called upon to appear before a court – and a jury therein – to explain how a series of events involving computers and computerised equipment unfolded and how the subsequent evidence against the individuals in question was gathered.
This is called ‘providing an expert witness’ and is sometimes the most important element of any prosecution made against an individual or group of individuals. This information must be imparted to the jury in a manner they will understand using both visual and audio aids if required and also demonstrations.
Computer forensics – as we have already mentioned – is fast becoming one of the most important elements of the forensics environment and also one of the most useful tools in the arsenal of the police in their fight against crime in its many guises.