The article basically talks about the latest discovery in law, e-Discovery, which is supposed to aid in making the entire investigation process more conceptualized and efficient than before.
Standing still and refusing to keep up with the latest trends is generally discouraged in the security world. In the field of computer forensics, practitioners are constantly in a technological ‘arms race’ with computer hackers while software and devices are constantly changing.There is an absolute need to be able to find evidence on whatever technology is out there such as the latest discovery in law, or e-Discovery.
Forensic experts seek to explain computer evidence in plain language, but often this discipline remains inaccessible to the legal, risk and investigations professionals who desperately need it. What is clear is that, in our rapidly evolving technological environment, computer forensics has no doubt an important part to play across the gamut of corporate investigations.
In fact, computer forensics has been most successful in proving how technology was employed either as a tool to commit or support a crime. Your computer can be your closest companion, and it knows all your secrets, but it can reveal every single detail pertaining to you to a forensic expert.
The first thing an expert must do is preserve the ‘crime scene’ in accordance with best practices. Experts will take a forensic ‘image’ of a computer hard drive, live memory, network traffic or other data in a manner which is complete, defensible and traceable. Once captured, data is treated like any other evidence: it is usually tagged and secured with each step in its physical transfer being recorded in a digital document.
However, as with any crime scene the danger of destruction or contamination of evidence is very real and could collapse your case. Experts are very wary about executing any action that could result in changes to the media being imaged: something as simple as turning on a computer can cause thousands of potentially useful artefacts to be overwritten and destroyed.
By piecing their way through a forensic image, investigators can uncover the “tracks left behind in the ground” that can reveal a suspect’s activities. A fragment of Google search history, a recently used document list or a record of copying data to an iPhone can all be pieced together into a timeline of events to slowly dissect the suspect’s intention at that critical point of time.
The number of wireless devices continues to grow into a large ‘Internet of things’. When searching a desk, we now have to grab the desktop computer but also look out for USB drives disguised as pens, digital cameras disguised as tissue boxes and a myriad of MP3 players, smart phones and other devices.
In 2012, this community will need to concern itself with ubiquitous computing, latest discoveries in technology and new wireless applications. Put simply, it’s not a time to be standing still.
