Security Compromise Assessment

Throughout this course many software packages have been discussed as far as their usefulness and application in a computer forensics environment. I have chosen to write about encryption, as well as anti-spyware software. Specifically I will discuss TrueCrypt and Spybot – Search and Destroy.

It is the computer forensics job to look through all of the computer files, even the deleted ones, to see if there are any incriminating files that would prove them guilty. Even reporting them to the jury is one of the jobs that a computer forensic person might have. Not only does this community work closely with eh police force, they can also work within the FBI or a company that uses computers in their business like Apple. Th...

“Computer forensics is the specialized practice of investigating computer media for the purpose of discovering and analyzing available, deleted, or "hidden" information that may serve as useful evidence in a legal matter. “ (Steen, Hassell 2004)

Britz, Marjie. 2009. Computer forensics and cybercrime: an introduction. Upper Saddle River, N.J.: Pearson Prentice Hall.

In our modern society, computers and other digital devices are becoming ubiquitous. In the late 1970’s the number of crimes that involved digital devices and computers has been increasing rapidly. As a result of that, computer experts specified the need for permanently improving digital forensic tools and practices.

As ISO/IEC 27037 addresses the process of how the digital evidences are to be handled but all these processes addresses the traditional digital environment. But as with the development of cloud the scenario has changed a lot. Cloud computing brings new challenges in front of investigators. These challenges may include various issues like virtualization of servers to multiple locations, dependence on CSP for access to logs etc.

Nowadays, most of the web, email, database and fileservers are Linux servers. Linux is a UNIX system which implies that it has solid compatibility, stability and security features. Linux is used for the mentioned environments because these services require high security. Further, an increase of attacks on these servers can be observed. Additionally, the methods to prevent intrusions on Linux machines are insufficient. Further, the analysis of incidents on Linux systems are not considered appropriately (Choi, Savoldi, Gubian, Lee, & Lee, 2008). It can also be observed that a lot of investigators do not have experience with Linux forensics (Altheide, 2004).

However, what of the inter world? That is where computer forensics comes in, to treat/fix the hole and bring the culprit to justice. Therefore, where software security bring forth prevention, computer forensics, incidence response, calls for treatment. What exactly is computer forensics? It is a toolbox of science, which contains tools and methodologies to recover both passwords and deleted data, to analyze network traffic and logon/logoff times, to snoop and sniff out, as undercover agents do, rotten apples in the barrel. Due to the nature of each incident, the nature of the case may be legal, political, business, or technical oriented. Consequently, one could gather how much a computer means in people's lifestyles nowadays. Nevertheless, computer forensics team (aka: incident response team) are popping up around the world, due to the global nature of the internet, which makes it a lot harder for local law authorities to oversea and prosecute local crimes executed remotely outside the country.

Now let’s look at few tools that are used in the field of digital forensics [1] like disk and data capturing tools, Internet analysis tools, hidden file viewers, deleted email recovery and analysis tools and network traffic analysis tools.

Carrier, B. D. (2006). Risks of live digital forensic analysis. Communications of the ACM, 49 (2), 56-61.