Anti Forensics Essay

John Irvine described a computer forensic analyst as having many job titles such as digital forensic analyst, media exploiter, and computer forensics investigator but they all do the same thing which is delve deeply into computers that have either been the victim, instrumentality, or witness to a crime. (John Irvine, forensicsfocus.com) Computer forensics is the art of collecting, analysing, preserving and presenting digital evidence collected from a computer in a legally acceptable manner (Darshan Karia, digitalforensicsmagazine.com). Although a computer forensics analyst aids in solving crimes, it faces the challenge of anti-forensics which can distort evidence that can result in misleading results and/or inadmissible evidence.

Anti-forensics is the “practice of attempting to thwart computer forensics analyst.” (forensicscontrol.com) This area includes encryption, over-writing of data to make it unrecoverable, the modification of files’ metadata, and file obstruction which is disguising files (forensicscontrol.com). Anti-forensics can prevent evidence collection, increase investigation time, provide misleading evidence that can jeopardize the whole investigation, and/or prevent detection of a digital crime (Alharbi et al. 59). According to Gary C. Kessler, the categories of anti-forensic methods are data hiding, artefact

According to Daubert, a judge can determine the admissibility of scientific evidence based upon four factors: testing, error Rate, publication, and acceptance. (Daubert v. Merrell Dow Pharmaceuticals) If evidence presents itself that can call into question the reliability of other evidence then that evidence becomes inadmissible. (Kessler 3) However a judge’s determination of admissibility can differ from day to day therefore a case may not be given the same open or closed perspective as another due to the evidence