It’s a cold winter night in December John’s family toy store just close for the night after a busy holiday shopping spree. The local toy store cash register draw is packed solid with hundred-dollar bills. The night manger is tired and leaves the cash sitting in the register for the night. The 2 masked bandits of widget town smash out the front window breaking in stealing all the money out of the register draw walking away with six thousand dollars. Local police are called in to investigate police call out their forensic detectives to dust for fingerprints to help find the people or person who committed the crime.
This above story was a common way people stole money a how police investigated the crime using forensic. But it all started to change in the late 1970’s. Computers have opened the door to not only people using them to steel money instead of the old brick through the front window trick. But computer have opened the door for stealing money, sending illegal photos, steeling company information and secrets, and sending death threats. As Computers evolved into everyday life police need a new way to investigate crimes that’s when Computer forensic started.
What is computer forensic. “Computer forensics has come to mean the identification, preservation, extraction, documentation, and interpretation of digital evidence on computers or other electronic media for evidentiary purposes” (Whitcomb). Recovery of deleted files and doings on a computer turns into a puzzle where every little piece must be out back together.
Common ways files and information is obtained from computers are as follow web browser cache, temporary files, key board buffer, and file delete. These are commons techniques that are used by computer forensics in their investigation. when investigators are going through computers, they must be careful of privacy violations exposing passwords and pictures that aren’t part of the investigation. If they are reconstructing a computer for bank fraud used to steal thousands of dollars and they find child pornorghy in file history. That evidence can’t be used against that person[footnoteRef:1]. [1: Amendment that protects from unwarranted searches and seizure.]
When using the internet every time you search something the computer has a special location that is called a cache directory that stores where you went. The directory is used to store your history so next time you go on the same site it loads up faster. But the only problem is it leaves a great bread crumb trail for investigators to follow where you went on your computer. I f you look in C:windowshistory you will be able to find your cache history. If you are looking to clean your cache history, they make programs that will clear and delete your history. Unfortunately, with a undelete program your cache history can be recovered.
Temporary files are created automatically incase your computer was to crash. Common programs are Microsoft Word and Excel that create a temporary recover file incase your computer was to crash. The temporary files no matter from Microsoft or a different program will stay on your hard drive until another file or program write over top of the file. If you type out threat letters and think that encryption or deleting it will remove it your wrong, it will only protect the original file it will not cover it up from investigators.
Every time you stroke your keyboard keys it goes into a spot called keyboard buffer which is a temporary holding for the data. Ounce the file for example in Microsoft word is closed the keyboard buffer dumps the data that it collected into the computer memory. Investigators must use special programs to recover and find the data. File deletion programs will not be able to remove it.
If you are asking yourself, I deleted that 2019 tax return that I lied on that no way that they can find it your wrong. Deleting a file does not wipe it off your computer it just basically puts white out over the file name so you can’t see the file. “If you have sensitive information that could get you in trouble with the law, your spouse, or your boss, you can often wipe out all traces of your incriminating files using a special file-wiping program, either using a file deleting feature in a utility or a dedicated file -deleting program like BCWIPE(www.jetico.com)” (Wang). File deletion programs act like a paper shredder putting the file into little tiny puzzle pieces into the hard drive scattered all over that makes it very complicated to paste the data back together. But that’s why we have computer forensics its not impossible to solve.
What happens if you do delete a file that you did not want to delete. Can your wedding photo be recovered with out calling a computer forensic investigator? Longs your computer has not written over the file with another file already then yes you can save it. Norton Utility and Recuva are examples of programs that can restore your deleted files to make you your own file recovery specialist.
No matter what program you use to delete your file unless you remove the hard drive then smash it burn sink it to the bottom of the ocean they will find a away to use computer forensic to find out what you did to prosecute you.
Bibliography
- Aminnezhad, Asou. ''A survey on privacy issues in digital forensics'.' 2012. Gale Academic OneFile. Report. 17 march 2020. .
- Carvey, Harlan. 'Windows Forensic Analsis Toolkit.' Advance analysis Techniques for Windows 8. Elsevier Science & Technology Books, 2014. 1-3.
- Wang, Wallace. 'Computer Forensics.' May 2000. Gale General OneFile. Article. 17 March 2020. .
- Whitcomb, Carrie Morgan. 'Digital Evidence.' 2014. Access Science McGraw Hill. Aaron Biernacki
