Tammy Alexander

Forensic Examination in a Terabyte World

How do you find needles in a haystack when haystacks are becoming larger and more compact? How long does it take to find the needle? The exponential growth in data storage is an ever-increasing challenge to the digital forensic community, specifically in matters of accounting for the volume of data, the cost of analyzing it, and the integrity of the evidence produced from it.

Developing an Enterprise Digital Investigative/Electronic Discovery Capability

Developing and implementing an enterprise digital investigative or electronic discovery capability is a costly, time-consuming, and resource-intensive proposition for any enterprise. An organization needs to have a firm understanding of its requirements in these areas before embarking on the path to create an internal capability to conduct digital investigations and electronic discovery. It is neither inexpensive nor easy to develop and implement this capability in an organization. After careful consideration and deliberation, if the decision is made to move forward on this path, numerous considerations will need to be identified and managed for the successful development and implementation of a program. The administrative considerations to implementing a digital investigative and electronic discovery capability require careful thought and deliberation. These considerations will be similar regardless of whether the facility is small or large. The framework and structure need to be in place as soon as possible before any collection or analysis of digital information takes place in the enterprise.

E-mail Forensics

There are many tools that can process through e-mail archives. Each tool has its positive and negative points that should be evaluated prior to purchase. No matter which tool is purchased, it is essential to insure that the test to check its positive and negative points is validated and conducted properly. Since there is no standard available on how to process all the different proprietary mail formats, each tool can receive slightly different results in the processing. Network E-mail Examiner (NEMX) is one of the most common tools that can be used to process MS Exchange archives as well as Lotus Notes and GroupWise. Built into the tool is a corruption repair utility that will also save some time in processing by attempting to bypass corruption and moving on to read the rest of the archive, allowing the data to be kept in its original state Some people prefer to use tools that are the mail clients for processing the data associated with the archive. This can be problematic because these tools are not specifically designed for forensics. Therefore, much of the deleted data would be missed in the processing.

Digital Forensics: An Overview

Through the efforts of computer scientists, law enforcement and intelligence officers, network and system administrators, programmers, academics, and hobbyists, the field of digital forensics has evolved (and is still evolving) into one of the most dynamic and powerful investigative techniques in use to date. Digital forensic managers and investigators face a host of procedural, legal, operational, and technical challenges driven by both the explosive pace of technological innovation and the sophistication of cybercriminals. To assist them, this chapter will provide an overview of digital forensic principles and methodologies and the differing digital environments encountered. This chapter is not a step-by-step digital forensic procedural manual, as plenty of books already do that exceedingly well. My goal is to provide an overall framework for thinking about digital forensics that will guide how you apply digital forensic procedures while managing and performing digital forensics.

Starting a Career in the Field of Techno Forensics

The field of computer forensics has exploded within the past 10 years. Only a few short years ago, a search for computer forensics-related degree programs yielded only about 10 or so colleges that even offered computer forensic coursework. Today, hundreds of multidisciplinary computer forensic programs are available across the United States.

Chapter 3 – Developing an Enterprise Digital Investigative/Electronic Discovery Capability

Publisher Summary Developing and implementing an enterprise digital investigative or electronic discovery capability is a costly, time-consuming, and resource-intensive proposition for any enterprise. An organization needs to have a firm understanding of its requirements in these areas before embarking on the path to create an internal capability to conduct digital investigations and electronic discovery. It is neither inexpensive nor easy to develop and implement this capability in an organization. After careful consideration and deliberation, if the decision is made to move forward on this path, numerous considerations will need to be identified and managed for the successful development and implementation of a program. The administrative considerations to implementing a digital investigative and electronic discovery capability require careful thought and deliberation. These considerations will be similar regardless of whether the facility is small or large. The framework and structure need to be in place as soon as possible before any collection or analysis of digital information takes place in the enterprise.

Integrating a Quality Management System in a Digital Forensic Laboratory

Over the course of my 30-plus years in law enforcement and forensic science, I have been involved in various aspects of quality systems development. I have been exposed to “Management by Objectives,” “Total Quality Management,” plus many of the latest business management fads. While each had elements of interest and value, none really struck a chord with me. It was not until I participated in formal project management training and worked in a “projectized” organization that I internalized the true value of an effective quality management system.

Balancing E-discovery Challenges with Legal and IT Requirements

Implementation of a discovery readiness program is not straightforward. Utilization of trusted sources and tools brings E-discovery one step closer to implementing a program that works. As the industry continues to evolve, additional tools and techniques will be available in the market. E-discovery engineers will also become more prevalent as the industry evolves with their new methodologies, inventions, and ideas. Legal and technical teams need to bridge the gap by creating a process before venturing down the road of e-discovery. Unfortunately, the process is not perfect. There are preservation, collection, processing, and review issues, but through team effort, these issues can be minimized. There are several techniques and tools that can be used to identify the gaps in the process.