Technology is constantly changing, and as the capabilities change, so do the issues in Forensic information technology (FIT). FIT is defined as the scientific use or application of information technology (IT) that is used to generate and present digital evidence to be used in courts, legal or other formal proceedings (Volonio). While the use of technology helps get things done faster, it also can present many issues if the proper procedures and tools are not used and followed. An existing issue in FIT is computer forensics, in regards to preserving digital evidence and effectively conducting a computer forensics investigation. Computer forensics can be defined as the who, what, when, and how of digital (electronic) evidence and how techmology is used to preserve, authentic, and analyze the evidence collected (citation 17utah). If obtained evidence is not handled propely, this could jepoeradize its reliability when being admitted into court. It is important to identify the issues, possible solutions, and the type of technology that is used in computer forensics, especially during a computer forensic investigation. This paper will provide an insight to the existing issues in FIT such as computer forensics, with emphasis on preserving digital(electronic) evidence and the issue of effectively aquiring, authenticating, and analyzing retrieved information during a forensic investigation.
17utah pg. 10-11
Computer forensics is the application of analytical techniques on digital media after a computer security incident has occurred. Its goal is to identify exactly what happened on a digital system and who was responsible through investigative procedure. Computer forensics involves the preservation, identification, extraction, documentation and interpretation of computer data (warren ). As stated previously, Computer forensics is the "who, what, when, and how" of electronic evidence. When it comes to handling digital evidence, computer forensics uses various technology to recover, authenticate, and analyze electronic data in a case. Some other ways computer forensics is used are with issues relating to collect data about computer or device usage, examining residual data, authenticating of data by analysis using different toolkits and technical aspects(warren ). It requires specialized expertise that goes beyond normal data collection and preservation techniques available to end-users or system support personnel. This is a very crucial point in a foresic investigation that relies heavily on FIT because any evidence that is not handled properly will not be admissible in court.
Issues in Preserving Digital Evidence
Digital evidence is defined as any evidence of a crime that is neither physical nor human, but, are electronic impulses and programming codes (1279 Pg. 29). This type of evidence can take the form of data digitally stored as: text files, graphics files, sounds, motion pictures, databases, temporary files, erased files, and other...