Computer Forensics: Towards Creating a Certification Framework

Computer Forensics: Towards Creating a Certification Framework

INTRODUCTION TO COMPUTER FORENSICS & THEINVESTIGATION PROCESS

At an apartment in a blue collar neighborhood of South-East London, a police officer saw a plethora of luxury automobiles. Because of the neighborhood the police officer thought there might be illegal activity occurring at the apartment. The officer called in his suspicions and later raided the apartment resulting in the arrest of numerous members of the “iPod crew”. From December 2001 to October 2002 the iPod crew stole approximately 70 luxury automobiles (Carter, 2004). The iPod crew purchased the automobiles from dealers using fraudulent documentation. During the investigation police seized an iPod™ and discovered numerous documents used for fraudulent transactions and bank notes to resell the automobiles to unsuspecting individuals. The bank notes acted as proof to the buyer that there were no obligations on the automobile leading the buyer to believe the automobile had a clear title (Howe, 2004).
Crimes perpetrated using technology such as the iPod Crew is becoming more common as a result of the advent of the Internet and rapid growth in technology. Because of the use of computers as an accessory or sole means to commit a crime, computer forensics emerged.The usage of computer forensics has not come without challenges in court regarding the reliability and validity of 2 the practice. With the current contentions surrounding computer forensics, steps toward sound solutions need to be considered to aid in the field’s development. The fact is computer forensics will continue to expand correlating to the growth of the Internet and the quantity of legal cases involving computers. As shown in figure 1.1 the number of reported incidents to CERT®1 has continuously increased each year.CERT Incidents Reported
Incident
0, 20000, 40000, 60000, 80000, 100000, 120000, 140000, 16000
Year
1988-1999, 2000, 2001, 2002, 2003
Figure 1.1 CERT® Incidents Reported (CERT/CC, 2004)
1 CERT/CC® is based at Carnegie Mellon University. The purpose of CERT/CC is to strengthen
Internet security by having entities report incidents so CERT/CC can issue reports and responses to mitigate risks. CERT/CC also provides training and assistance in incident response.

WHAT IS COMPUTER FORENSICS
To obtain information from the iPod used by the iPod Crew for use in acourt of law, the police utilized computer forensics. Computer forensics is a sub-disciplineof Digital Forensics. Digital forensics is “the use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources…” (Palmer, 2001).Digital forensics includes other forensics specializations such as network and media forensics. Computer forensics is the “use of an expert to preserve, analyze, and produce data”2 from volatile and non-volatile media storage (Mack, 2003). Computer forensics encompasses computing devices and related media that may be used in conjunction with a computer such as an iPod, or a multimedia player.
The domain of computer forensics is vast. To limit the domain, this paper will focus on legal issues that have and may occur in the computer forensics investigation process (i.e., Fourth and Fifth amendments, and state law are beyond the scope of this paper; however, the author does recognize the inherent legal issues regarding the aforementioned amendments).

 

What Computer Forensics Involves
When Police Officers in London confiscated the iPod from the iPod crewthe computer forensics process started. In an ideal situation the police officers 2A portion of her definition was used; however, the entire definition was not used because of the limited scope presented as she used only single hard drive examination as computer forensics.“Computer forensics is the use of an expert to preserve, analyze, and produce data …”
4 would have performed (in a high level overview) the following procedures.Upon identifying the iPod as potential evidence, the police officers should take photographs of the scene and what is displayed on the iPod. In most cases the best thing for a police officer to do is request an expert, but for cases when that is not an option, it is recommended that the officer does not power on a device if found off, find the power source if on (e.g. laptop power adapter), or power off the device by removing the power source, to prevent spoliation/contamination even though potential evidence in volatile memory may be lost; in this case removing the battery for the iPod.
The next step is for the officers to “bag and tag” the iPod for transportation while keeping detailed notes of all materials seized and procedures performed. For transportation of the device the officers should keep the evidence, (i.e., the iPod), in a static free bag away from electronic disturbances, such as magnets and radio transceivers. When the officer arrives at the storage facility proper documentation and tagging (chain of custody) should occur for the transfer of the evidence. The investigator should inform the examiner and/or expert about the case and any pertinent information. During the entire forensic process the examiner and/or expert should document each time evidence is checked in and out (chain of custody) from storage and what procedures are being used for extraction, analysis, and preservation of the evidence. During the analysis phase the expert should make an exact copy of the original data using a variety of methods ensuring that the copy is identical to the original. To help ensure that the original is never altered the identical copy will be used for analysis.To extract information from the iPod the expert should use software and hardware(tools) to sift through the data. At the conclusion of the investigation the expertshould preserve the evidence and present the findings in a court of law if required.

Who Uses Computer Forensics
Computer forensics usage is vast and growing rapidly. Computer forensics has been and continues to be used for criminal and civil litigation, educational studies and research in academia, and in the corporate world. In academia, computer forensics is taught and researched to improve the emerging field. The ability to educate and improve upon the emerging field is critical and academia is a crucial component in establishing computer forensics as a recognized and respected scientific field of study. The corporate world primarily uses computer forensics for civil litigation (i.e., trying to discover how employees have been using corporate systems). For example, a case that will be presented in more detail in chapter 2 is between the Four Seasons and Consorcio. Through computer forensics, Four Seasons was able to prove that Consorciowas attempting to circumvent their network security and providing fraudulent data to the courts. The last primary user of computer forensics is the government. For the purpose of this paper government includes law enforcement and not military and intelligence branches. The usage ranges from trying to discover what a terrorist 6 may have on his/her computer to childpornography. The most numerous casesare child pornography with intellectual property and identity theft increasing rapidly.
The focus of the paper will be on the law enforcement usage and related actors and roles as those are dominant in the field.

ACTORS & ROLES IN THE COMPUTER FORENSIC INVESTIGATION PROCESS
When the police officers arrived in South-East London (discovering theheadquarters of the iPod crew) the officers did not know what they were going to find. The officers who where first on the scene had to collect and preserve the integrity of evidence. The officer in this instance is classified as a first responder. A first responder is the first person on the scene (i.e. police officer) responsible for preserving evidence in the condition it was found.With such a task, the first responder needs to have a working knowledge of how the computer forensics process works, to prevent contamination of potential evidence. Several guides have been released to assist first responders identify and learn how to secure and maintain the integrity of potential evidence (e.g., Electronic Crime Scene Investigation – A Guide for First Responders by the National Institute of Justice). After the initial discovery an investigator will be assigned to find further evidence in the case if applicable. The investigator will interact with the first responder(s) and the examiner(s) and/or expert(s) to collect evidence to reconstruct the crime scene(s) and the events that occurred. As a result of the 7 infancy of computer forensics, the investigator may also play the role of the examiner and/or expert. When computer forensics has been contested, the expert is the actor most crucial for court proceedings. The role of the examiner is to extract and preserve the evidence while the expert analyzes, interprets, and presents results. The examiner will normally be called upon by the court for expert testimony. During this process the expert must qualify his or her credentials, procedures used forexamination, and the end results. Chapter 2 discusses the court process and the need for a creation of a framework.

CHAPTER TWO
LEGAL CHALLENGES TO COMPUTER FORENSICS

Computer forensics is in the early stages of development and as a result, problems are emerging that bring into question its validity in the United States (U.S.) federal and state court systems. For practical purposes, the legal issues relevant to computer forensics are:
• admissibility of evidence;
• acceptability; and
• analysis and preservation
Historically, a significant portion of court cases were settled before thetrial.3 In many other instances, computer forensics evidence was never contested. However, when computer forensics evidence is contested, this builds the foundation to evaluate what, why, and how those issues should be considered when creating computer forensic standards and certifications to meetthe requirements for the U.S. federal and state court systems (i.e. legalprecedent).
The U.S. Department of Justice maintains a site listing current and past select cases on cyber/computer crimes available at http://www.cybercrime.gov. The important aspect is to notice the amount of cases where the indicted person plead guilty.

SEARCH AND SEIZURE
Search and seizure of digital evidence is the first process that is oftendisputed (Mandiaet al, 2003). If this step was not completed properly (i.e., illegalsearch and seizure or improper methodology), the defense or prosecution’sevidence may not be admitted. Traditional non-digital instances of search and seizure contentions have been evaluated by courts using precedents (Miranda v.Arizona, 1966; Katz v. U.S., 1967; Illinois v. Andreas, 1983). In contrast, digital cases are still emerging as the technology is new, resulting in few precedents toapply.
As such, the methods law enforcement entities use with computer crime investigations become an issue. Currently, there are no rigid standards or methodologies.
A unique issue with computer forensics search and seizure, centers on the source of the item(s) in the warrant or in verbal/written affirmation when a warrant is not needed (i.e., open view resulting in a search and seizure). For instance, when a computer has the power turned off, the data in volatile memory is impossible to reconstruct. In pre-digital crimes, electricity was not a major factor in the ability to execute a proper search and seizure.

Although there are not any documented U.S. federal or state court cases that have addressed this issue, it is a possibility in the future. In the United Kingdom, one defendant questioned the validity of improperly seized volatile media storage (Leyden, 2003).4 Aaron Caffrey, the defendant, was arrested under the suspicion of launching a denial of The Caffrey court case regarding the trojan defense led to his acquittal in the denial of service attacks on the Port of Houston. The prosecution and expert in the case fear that the courtsdecision will lead to a new defense tactic – the trojan defense. This is an important case in the possible need to change current guidelines on how to deal with a ‘live’ computer.
Service attack against the Port of Houston’s systems on September 20th, 2001
(BBC News, 2003). The defense argued that a trojan5 was installed on thedefendant’s computer by others who wanted to frame him for the attack (Leyden,2003). The trojan, the defense contended, launched the attack from the defendant’s computer but the defendant was not aware of the attack. The forensics examination showed that there was no sign of a trojan, only attack tools on the computer, but could not rule out that a trojan may have been in volatile memory (random access memory) (Leyden, 2003). The jury unanimously decided that the defendant was not guilty (Leyden, 2003).
Though courts may grant a search and seizure warrant, law enforcement may ask individuals for verbal or written consent to search and seize items without a warrant; however, the voluntary nature of consent may vary. In Willifordv. Texas,6 the appellant complained that the search and seizure of his computer was illegal. The appellant contended that his consent to the search and seizure was tainted, and as there was no warrant, there was no probablecause. The judge dismissed the claim. In U.S. v. Habershaw, the issue was whether the officers involved had the right to search and seize the computer, and 5“A destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves but they can be just as destructive. One of the most insidious types of Trojan horse is a program that claims to rid your computer of viruses but instead introduces viruses onto your computer” (Webopedia, 2004).
6 Appellant took his computer to BCI for repairs where a technician discovered what he believed to be child pornography. BCI gave the appellant the choice to call police or they would to reportthe matter – appellant complied and had called the police. The detective on scene, Owings, readappellant his Miranda rights, appellant signed a waiver. Owings requested appellant if he could search and seize the computer, appellant complied. Court cited Texas v. Brown and Waugh v.
Texas “the facts available to the officer would warrant a man of reasonable caution in the belief that certain items may be in contraband or stolen property or useful as evidence of a crime” Detective Owings had met the requirements – the court dismissed the voluntaries of appellant’s consent to search.
11 if the defendant was capable of giving consent. The defendant argued that the warrant went “overboard” (U.S. v. Habershaw, 2002).
The defendant gave verbal permission for the officers to operate his computer after the defendant stated the possible location of contraband child pornography images on the computer.7 The defendant contended that the officers did not have probable cause, even though the contraband was in plain view.8 The defendant also argued that he was incapable of giving verbal consent.9 The court found against the defendant in respect to the aforementioned objections. Furthermore, Habershaw, argued against the warrant issued, by stating it was in violation of Federal Rules of Criminal Procedures (FRCP) Rule 41.10 Habershaw contended that the harddrive was searched too extensively; exceeding the search warrant because it was conducted using a sector-by-sector11 search (U.S. v. Habershaw, 2002).
The defendant complained that technology is available to do searches bykeywords that would not exceed the scope of the search warrant (U.S. v. Habershaw, 2002). Additionally, the defendant disputed the length of time the 7“The court upheld searching in which an officer asked defendant to open computer files showingon screen, and defended consented. U.S. v. Lemmons, 282 F.3d 920,926 7th Circ. 2002 –upholding search of computer, where defendant assented to officer’s request to her the officer operate the computer” (U.S. v. Laine, 2001).
8“Where the initial intrusion that brings the police within view of such an article is supported, not by a warrant, but by one of the recognized exceptions to the warrant requirement, the seizure is also legitimate” (Coolidge v. New Hampshire, 2002).“Police have legal access to property and contraband they come across while acting pursuant to an exception to the Warrant Clause” (Texas v. Brown, 1983).9 The court entertained Dr. Schwartz who diagnosed Habershaw with impulse control disorder and gender Identity disorder. Neither of which gave persuasive evidence to Habershaw not being able to give voluntary consent. 10 Federal Rules of Criminal Procedure Rule 41 outlines the process of search and seizure in respect to how officers define the warrant to the court (LII, 2004).
11 “Sectors are the smallest physical storage units of a disk – Each sector stores 512 bytes of data” (Rogers, 2004).12 search took as FRCP Rule 41 has a ten-day limit. The court denied bothcomplaints by the defendant stating: This execution of the warrant, namely the seizure of the electronic information on the hard drive, took place well within ten days allowed. Further forensic analysis of the seized hard drive image does not constitute a second execution of the warrant or a failure to “depart the premises” as the defendantclaims, anymore than would a review of a file cabinet’s worth of seized documents (Coolidge v. New Hampshire, 2002).Coolidge v.New Hampshire lays the foundation for the ability to analyze computer evidence in the ruling it was stated that the forensic analysis process did not constitute a second search and seizure, therefore not violating the tendaylimit in FRCP Rule 41.
The judge ruled that using a bit-streamed image does not constitute a second execution of a warrant.

 

ADMISSIBILITY OF TOOLS
There are three primary methods to satisfy the U.S. federal and state court systems requirements for scientific evidence, Frye, Federal Rules of Evidence (FRE) 702, and Daubert. This section will focus on the two primary standards commonly used today, Daubertand FRE 702. To13 properly cover admissibility of scientific evidence (admissibility of computer forensic tools), the rulings from the Supreme Court in Kumho Tire Companyv. Carmichael will be considered rather than the FRE 702 interpretationbecause of the differences between the Supreme Court ruling and interpretation. It is important to keep in mind that Daubertis based on the principle that the judge acts as a gatekeeper – filtering out the “junk Science.”However, this principle normally relies on the attorneys contending the qualifications of an expert, the scientific nature of their evidence, and the validity and reliability of the methods and tools employed. If the tools do not meet the requirements as set out in the guidelines, the findings from these tools may not be admissible or given less importance.When experts analyze evidence they utilize tools. Tools may include imaging hardware and software write blockers and software suites such as EnCasand Forensics Tool Kit™ (FTK™) used in the computer forensics investigation.
This section examines Daubertand applicable sections of FRE to determine if computer forensics tools meet the standards for acceptance as scientific evidence; the primary focus is on analyzing the reliability of the tools,peer review status, and acceptability (see Table 1).

Reliability & Validity
To determine reliability and validity under Daubertand FRE 702, several factors are required: known or potential error rates, testing, and commonly 14 agreed upon methods. Here again the computer forensic field has fallen short. With the (computer forensics field’s) reliance on proprietary software (e.g.,EnCase and FTK), the issue of error rates is an unknown. The vendors have not published information relating to error rates or even the exact reasons for minor and major version changes. Furthermore, the community is prevented from conducting in depth tests by the licensing contracts and legislation such as the Digital Millennium Copyright Act (DMCA) (U.S. Copyright Office, 1998).Given the restrictions on full error testing and reporting, one method to establish some validity is to prove the reliability of the imaged or extracted data. If a forensic examiner makes a bit-stream image of the original source, the examiner can then compare the hash of the file structure of the original to the forensic copy by utilizing tools (checksum12 algorithms) such as MD513 or SHA1.14 These tools provide reasonable reliability that the image or the data written to a drive(s) is identical to the original and thus can be considered best evidence (Ohio v. Cook, 2002; Four Seasons v. Consorcio, 2003). 12 “A simple error-detection scheme in which each transmitted message is accompanied by a numerical value based on the number of set bits in the message. The receiving station then applies the same formula to the message and checks to make sure the accompanying numerical value is the same.
If not, the receiver can assume that the message has been garbled” (Webopedia, 2004).
13 “MD5 is a one-way hash function, meaning that it takes a message and converts it into a fixed string of digits. When using a one-way hash function, one can compare a calculated message digest against the message digest that is decrypted with a public key to verify that the message hasn’t been tampered with. This comparison is called a “hashcheck”” (Webopedia, 2004). 14“The Secure Hash Algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest that is designed so that it should be computationally expensive to find a text, which matches a given hash. I.e. if you have a hash for document A, H(A), it is difficult to find a document B that has the same hash, and even more difficult to arrange that document B says what you want it to say” (DesAutels, 1997). Table 1 Daubert, Frye, and FRE 702 Criteria DaubertFRE 702 Kumho Tire Version “(1) such testimony was admissible only if relevant and reliable
“(1) can be and has been tested
(2) The Federal Rules of Evidence(FRE) assigned to the trial judge the task of insuring that an expert’s testimony rested on a reliable foundation and was relevant to the task at hand (2) has been subjected to peer review or publication (3) some or all of certain specific factors—such as testing, peer review, error rates, and acceptability in the relevant scientific community might possibly prove helpful in determining the reliability of a particular scientific theory or technique” (Kumho Tire, 1999).
(3) has (a) high known or potential rate of error, relevant to the scientific community– where such factors are reasonable measures of the testimony’s reliability; the trial judge may ask questions of this sort not only where an expert relies onthe application of scientific principles, butalso where an expert relies on skill or experience-based observation” (KumhoTire, 1999).
Frye FRE 702 “If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise, If the testimony is based upon sufficient facts or data. The testimony is the product of reliable principles and methods, and “The rule is that the opinions of experts or skilled witnesses are admissible in evidence in thosecases in which the matter of inquiry is such that inexperienced persons are unlikely to prove capable of forming a correct judgment upon it, for the reason that the subject matter so far partakes of a science, art, or trade as to require a previous habit or experience or study in it, in order to acquire a knowledge of it. When the question involved does not lie within the range of common experience or common knowledge, but requires special experience or special knowledge, then the opinions of witnesses skilled in that particular science, art, or trade to which the question relates are admissible in evidence” (Frye v. U.S.., 1923). (3) the witness has applied the principles and methods reliably to the facts of the case” (LII, 2004).16 While this approach can determine if an error occurred, it provides no information related to actual or potential error rates. Granted, there is testing for anomalies and reliability of some tools by third parties such as the National Institute of Standards and Technology15 (NIST). However, NIST does not assume liability for the results and does not certify or accredit any specific tool. One approach that many individuals have participated in and favor, isopen source as the end all solution to tool anomalies. In the 1960’s to 1970’s the open source community emerged based on the principle of sharing information –the code for software and hardware. One reason for open source is to have the ability to know the program code. In an effort to show that open source is superior to closed source there have been arguments raised that the use of open source tools may increase the reliability of digital evidence derived from these tools (Kenneally, 2001). Proponents of the open source movement have stated that because end users can examine the source code, it is more secure and thus more reliable. However, the ability to view the source code does not necessarily translate to better security or to meeting the requirements of reliability, testing, and peer review (Poulson, 2001). The openness means that the source code is often the work of several authors who may or may not be trustworthy, who may or may not follow any software engineering method, and the code can be altered at anytime including after formal testing for error rates. With the ability for the tool and the code to be altered after testing and be continuously altered, the 15 NIST.Computer Forensic Tool Testing Project.available from: http://www.ojp.usdoj.gov/nij/sciencetech/cftt.htm. This site presents results based on tests conducted at NIST on specified tools with the testing conditions so others may reproduce those results. 17courts may find that the tool does not meet the requirements. Simply put, open source does not mean that it is peer reviewed. Questions remain as to who are the ‘peers,’ where was the source code published (e.g., journals, conferences), and does the potential to be reviewed mean that it has been reviewed?

Peer Review
According to Daubertand FRE 702, the expert’s methods and processes must be consistent with methods that have been peer reviewed and/or published. The rationale being that, if the implementation of a theory is flawed, the results will be flawed; by requiring peer reviewing or publication, others in the relevant scientific community have the opportunity to discover flaws and supply recommendations or resolve errors prior to implementation. Hence, the tools used to derive the results must also be peer reviewed. A tool for computer forensics translates the basic manual processes into an application or device (e.g., storage preservation, recovery, and analysis). While there tends to be a
heavy reliance on tools, the courts have found that an inanimate object (e.g. a software package, a tool) cannot be considered an expert (State of Washingtonv. Leavell, 2000).16 This does not necessarily mean that the tool or results from that tool cannot be included in scientific testimony; the individual using the tool will often have to attest to the procedures used for it to be deemed admissible.16 The defense contended that an inanimate object, EnCase, cannot testify because it could not
be cross-examined and does not meet the Frye test (new standard is Daubert). The court found it was not possible for such cross-examination to occur but that the expert who utilized the software package may testify on its behalf on the scientific and procedures.18Currently there are only limited publications for computer forensics methods and processes. At the time of writing there are two peer-reviewed journals specifically dedicated to computer forensics, the International Journal of Digital Evidence17 and the Journal of Digital Investigations.18 It is uncertain whether the criteria for peer review requires publication in journals focusing in aparticular field, but based on the precedent set by other forensic sciences (e.g.,forensic psychology, DNA analysis), the lack of such journals and conferences does not help the effort.

Acceptability
In Daubert, section three requires that the applied scientific principle be accepted in the relevant scientific community. This assumes two factors: that there is a relevant scientific community and that community has accepted the principles. This is problematic, as computer forensics being a relatively new field may not have an established scientific community per se.
Currently the default has been to fall back on the use of established vendor tools as being industry standard and therefore accepted. However, in some instances the expert’s choice of a tool is based solely on the ratings available on web sites, with little or no direct testing being conducted by that expert (Willifordv. Texas, 2004).
The immaturity of computer forensics has further ramifications. The American Academy of Forensic Sciences (AAFS) has not fully recognized 17 International Journal of Digital Evidence. available from: http://www.ijde.org18 Journal of Digital Investigations. availablefrom:http://www.sciencedirect.com/science/journal/17422876 19 computer forensics as a scientific sub-discipline. To date the U.S. Court System has not commented on this fact, possibly because of the lack of technological depth. However, with the defense bar becoming more technically sophisticated, it is foreseeable that the recognition of the field and its underlying theory by the AAFS or a similar body will be a requirement for meeting the standards for scientific evidence. This requirement has been enforced with other pseudo forensic disciplines such as handwritinganalysis/forensics where experttestimony has been nullified based on the fact that the application of the theory did not satisfy Daubertand FRE 702 requirements.19

THE EXPERT
When conducting an analysis in computer forensics, the expert utilizes tools to examine and extract information pertaining to the crime. However, an area of concern is if one can be considered an expert solely based on his or her ability to use a tool, without the ability to clearly define how the tool works or knowing the program code.
The majority of the tools used in computer forensics19 Federal Rules of Evidence Rule 901 discusses the admissibility of evidence by the requirement of authentication and identification; particularly through illustrations. “The court is merely holding that the Government has failed to meet its burden of establishing that the proffered expert testimony in this case is admissible under Rule 702. Second, even if the court were to hold that handwriting analysis is not a field of expertise under the rules, that would not render Rule 901(b)(3) meaningless.
Rule 901(b)(3) does not deal exclusively with handwriting comparison, despite the fact that the Advisory Committee Notes for the rule discuss handwriting comparison testimony. Other types of comparison testimony are encompassed within the rule.
Last, and most important, Rule 702 and Rule 901 must be read together. Rule 901(b)(3)
contemplates testimony by an expert–but before an expert’s testimony can be admitted, it must past through the gates of Rule 702. In this case, Mr. Cawley’s testimony did not make it through the Rule 702 gate and, therefore, Rule 901 is irrelevant to the question of whether his testimony is admissible” (United States v. Saelee, 2001).20are proprietary and copyrighted, thus negating the ability to access the sourcecode.20 Currently, this inability of the expert to test the code and understand exactly what the tool is performing, has not hindered the admissibility of expert’s testimony. In Willifordv. Texas, the court found that an expert does not need to know the code of the software package (tool) nor the background processes.

However, this does not mean that the object or results from that object cannot be used for scientific testimony; although in some circumstances, the individual using the tool will have to attest to the procedures used. A possible argument to be made in court regarding the third criteria of Daubertis that the computer forensic community has accepted certain industry standard tools such as En-Case. However, with a field in its infancy, is it justified to say that the relevant scientific community has accepted certain tools? The current experts have to qualify their educational background, which includes courses taken by corporate (California v. Rodriguez, 2001) or federal agencies on how to operate software packages and conduct search and seizures. In some cases, the qualifications are that the “expert” is the computer expert for a local police force.
In addition, to have an expert discredited based on credentials, one must show deficient argumentation. In Broderick v. Texas, the appellant contested that “his counsel was ineffective for failing to object to evidence suggesting that he had been in possession of child pornography.” (Broderick v. Texas, 2000).
The prosecution’s expert was not able to discover any live files, only deleted files
20“Appellant’s counsel objected to Detective Owings’s testimony regarding the use of En-Case and images copied by it on the ground that Detective Owings was not qualified as an expert to testifyabout the theory or technique in developing the En-Case software or its reliability” (Willifordv.Texas, 2004).21that they were unable to reconstruct. The files recovered were descriptive in a sexual manner, some with names from the previous case of the contaminated hard drive. Moreover, the expert did not view any of the files (Broderick v. Texas,2000). “Broderick argues that his counsel should have objected to this evidence, and was deficient for failing to effectively cross-examine the witness and for failing to obtain his own expert witness to rebut the evidence” (Broderick v.Texas, 2000).
Although the court ruled against the appellant because this was not originally disputed and was part of a post-conviction relief motion, this is an issue of serious concern for future cases. In the U.S., every citizen is guaranteed a fair trial, if one is not achievable because of lack of expertise of legal counsel and experts in an area that could acquit the defendant, then the foundation of the legal justice system has been compromised.

ANALYSIS AND PRESERVATION
If the evidence makes it through the first two processes, it must be proven that the analysis and preservation was conducted properly. A common practice is to make a bit-stream image21 of the storage media that is to be examined. It is possible to use hashing algorithms such as MD5 or SHA1 to try to validate that the data written on the drive(s) is identical to the original. The courts have indicated that if the values computed for the source and image match, the image is a valid copy and considered to be original (Ohio v. Cook, 2002; Four Seasons .
A bit-stream image is one where a hard drive sends bit by bit, live and “dead” data to another hard drive.22v. Consorcio, 2003). In Taylor v. Texas, the testimony by the expert showed that he used a contaminated hard drive from a prior case to make a mirror image ofthe appellant’s drive. Furthermore, the expert formatted22 Taylor’s drive by accident when attempting to prepare the destination drive (Taylor v. Texas,
2002).

Unfortunately, the court did not make a decision on this contention and upheld the trial court’s decision. In all likelihood, the appellant was found guilty because of testimony of other witnesses. Nonetheless, the fact that a court would ignore that evidence was clearly contaminated should have more bearing in a case that is based strictly on computer evidence. Once the computer evidence is in the possession of law enforcement, steps must be taken to ensure that the evidence is not contaminated or destroyed. In Regina v. Caffrey(Leydon, 2003), the potential evidence was destroyed once the power to the computer was terminated. However, computer evidence may be lost by other means, such as age, electromagnetic force, and dropping of storage media.
In Ohio v. Cook, the defendant disputed several issues on the legitimacy of the data and the circumstantial evidence on whom was the creator of the files. “The state maintains that a forensic computer examiner will rarely, if ever, be able to find evidence actually placing a person atthe keyboard committing the crimes” (Ohio v. Anderson, 2004). The defendant claimed proper steps were not taken to ensure the integrity of the data on the 22 “To prepare a storage medium, usually a disk, for reading and writing. When you format a disk, the operating system erases all bookkeeping information on the disk, tests the disk to make sure all sectors are reliable, marks bad sectors (that is, those that are scratched), and creates internal address tables that it later uses to locate information. You must format a disk before you can use it.
Reformatting a disk does not erase the data on the disk, only the address tables” (Webopedia,2004).23 hard drive, such as placing the drive in a static bag (Ohio v. Cook, 2002). Thedefendant also contested the date and time of files on the system as the state did not test the CMOS23 for the current time of the system nor place a battery on the CMOS when put in evidence for integrity of the system clock. The defense’s computer forensic expert discovered the system clock was off by roughly five minutes and the defendant was not home during the times of all file creation (Ohio v. Cook, 2002). However, the court found that it is plausible to remotely access the system and create the files in question (Ohio v. Cook, 2002). The court also found that such measures as described to ensure integrity are not needed as the mirror image was authenticated to be an exact copy of the original (Ohio v. Cook, 2002). On the other hand, if the defendant was correct, the hard drive may have lost bits in transit, (Ohio v. Cook, 2002) possibly occurring if the evidence was placed next to a radio communication device with ample power in the back of a police cruiser causing data to be lost and resulting in bit manipulation (National Institute of Justice, 2001; National High Tech Crime Unit, 2003).
Although it is feasible that damage to the drive occurred, the likelihood of the bits being re-arranged to form child pornography is unlikely. Timelines are as important in pre-digital forensics as in computer forensics. In attempts to reconstruct when events may have occurred, the system clock is not always the most reliable device. In Ohio v. Anderson, the arguments raised were two pronged; if the time stamps were correct, the 23 “Personal computers … contain a small amount of battery-powered CMOS memory to hold the date, time, and system setup parameters” (Webopedia, 2004).
24 defendant claimed he did not own a compact disc recorder at the time, hence, itwas difficult to prove that the defendant made the compact discs (CD), and other storage media in question (Ohio v. Anderson, 2004). The first dispute was that the last creation date for the CD was January 1997, and the appellant did nothave a CD copier until August 1999. He also stated that his office computer’s multimedia player history file showed that no files were viewed from the CD in question (Ohio v. Anderson, 2004). The state found that Anderson knowingly possessed the pictures on the compact disc because of Internet chat logs of the defendant. However, Anderson was able to get charges dropped on a similar instance regarding a jaz® disc.24 As the state could not prove that the defendanthad knowledgeable possession of images on the media (Ohio v. Anderson, 2004), the court upheld its previous decision that it is rare to identify an individual at the computer where the crime took place; but plausible if other evidence supports that the defendant would have knowledge of the evidence such as chat logs or other deliberate actions.

In Four Seasons v. Consorcio, one controversy dealt with the creation offiles on the floppy discs (i.e., timeline inconsistencies). The plaintiff claimed the defendant made fraudulent discs that had been filed as evidence, destroying the originals. “Based upon the examination and breakdown of the serial number, Ashley determined that the floppy disc had been manufactured at the Verbatim® factory in Taiwan on the 154th day of 2002. The fact that these floppy discs were not the original floppy discs from February 2002 was clearly shown…”(Four24 A jaz disc is a removable media created by iomega®.25 Seasons v. Consorcio, 2003). It is difficult to have storage media containing evidence manufactured after the creation date of the evidence. While it was not a complicated method to prove legitimacy, it allowed the court, without hesitation, to disregard the defendant’s claims. This case also discussed the usage of log files and who was able to create signatures left in the log files. The log files are used to record authorized and unauthorized attempts to access privileged information and devices on the network. In this instance, the overwhelming amount of forged packets coming from Consorcio into Four Seasons wasevidence of blatant hacking attempts. This resulted in the expert from Consorcioreversing his previous claims that the logs were legitimate traffic (Four Seasonsv. Consorcio, 2003).
In attempting to manipulate the evidentiary procedures of the court, entities have, as in Four Seasons v. Consorcio, attempted to create fraudulent information.25 In Kucala Enterprises v. Auto Wax Company, the issue dealt with the software package Evidence Eliminator™,26 installed on the computer for the purpose to destroy evidence. The computer forensic expert was unable to determine the extent to which the aforementioned software was used; only that it had been installed on the computer in question (Kucalav. Auto Wax Company,2003).
The use of software to cleanly wipe data resulting in a low probability ofrecovery has been tested and proven. Not out of the ordinary, the court ordered Kucala to pay attorney fees and costs for court proceedings from the time Kucala25 Recall from Four Seasons v. Consorciothe duel over the floppy discs and evidence was claimed to be created prior to the manufacturing of the floppy discs. 26 Evidence Eliminator is a tool that claims to delete evidence securely so that programs that recover deleted files cannot recover files deleted with Evidence Eliminator.
26 first ran Evidence Eliminator up to and including the time, the parties appeared before the court for the hearing (Kucalav. Auto Wax Company, 2003).
The fine in this case was much less than what could have been if the evidence existed. The case was dismissed because there was no longer evidence with which to pursue legal action

To Place An Order For The Complete Project Material Pay N,5000 To

Guaranty Trust Bank (GTBank)
Acct. Name - Uwadia Eyemeka
Acct. No. - 0127561472

Then Send a text of your names, the topic you paid for, a valid email address to 07036785443

Speak Your Mind

*