FreeLists / cybercrime-alerts / "The Electronic Witness"

[alerts@xxxxxxxxxxx]

"The Electronic Witness" 
Security Management (03/02) Vol. 46, No. 3, P. 100; Bryson,
Curt 

Computer forensic analyses are essentially conventional
investigations when one considers that the recovery of
evidence may not be enough to prove a case. For example, in
one case involving an engineer, named Richard for the sake
of this article, who resigned his job with a utilities
company to work for a competitor, imaging hard drives on his
home computer and floppy disks was not enough to prove that
he stole proprietary information and gave it to his new
employer. Investigators still had to scrutinize the origin,
validity, credibility, and value of the evidence, especially
after the suspect's attorneys accidentally destroyed
evidence. The lawyers were trying to assess whether Richard
should be concerned about the private, family-related
material on the hard drive; Richard did want this to be
viewed. Dates and times were critical for this case, but
trained investigators were not able to seal and store
Richard's computers in a secure evidence facility
beforehand. Nonetheless, forensic analysis was a success, as
a result of hash files and keyword searches, and
investigators were even able to recover deleted directories.
Ultimately, proof of Richard's wrongdoing came when
investigators analyzed the application-specific logs stored
on the computer, which showed that proprietary files had
been accessed after his resignation, but before his attorney
reviewed the files on the computer. Software and hardware
are no different than evidence in the physical world such as
microscopes or bloodstains, and highly-skilled investigators
will continue to be the reason why crimes are solved.
www.securitymanagement.com 
 



--
This was sent to you from http://theMezz.com
To Subscribe/Unsubscribe go to http://techPolice.com

* Our Monthly Tech NewsLetter is at http://theMezzenger.com *