Intro to Criminalistics IP2

Computer Forensics

Criminalistics IP3 Name

Class

Date

Professor

Criminalistics IP3

Computer forensics is the science of the collection of computer evidence at a crime scene. In this crime scene a computer must be collected that is involved in a case of child pornography. In order to ensure that valuable data is not lost from the computer in the recovery efforts specific computer evidence collection methods must be followed. These collection methods will assist in protecting any evidence on the computer. Computer evidence must be collected following standardized forensic steps. In the case of the computer the collection process will begin like any other forensic collection with careful documentation of the evidence.

When collecting computer evidence the forensic investigator will photograph the computer evidence. This includes photographing the computer and the scene around the computer. It is important to photograph the computer evidence where it sits. If the computer is on photograph the screen. Next all live functions of the computer must be photographed. For example take a picture of a live wireless connection or the logged on users. Next the power cord is unplugged from the back of the computer. The laptop should also be unplugged from back and battery removed to ensure the computer shuts down (NIJ, 2010). Evidence tape will be placed over any open drives.

In order to be able to plug the computer back up exactly how it was found the forensic investigator will need to create a diagram of the cords and then all cords should be disconnected. All serial numbers on computer devices plus additional external devices should be recorded. All evidence must be packaged using anti-static evidence bags and then properly labeled before being transported to the lab. Any additional storage media, manuals, and additional computer equipment will be collected and set to lab. Computer evidence should be carefully transported and never be placed by magnets or radio transmission or the evidence could be destroyed.

In the process of collecting the computer is a pornographic image is located it should be carefully photographed without the computer being touched. People into illegal behaviors can set traps on their computer devices which cause illegal images and other information to delete. Having a record of the image will be beneficial to the court case especially if the computer evidence is later lost. A computer technician should never attempt to try and determine on scene if there was more pornography on the computer before attempting to remove it from the scene (NIJ, 2010). Computer evidence is delicate and can easily be destroyed.

When it comes to computer evidence the main rule has always been to not touch the computer just unplug, remove, and book into an evidence room. The proper collection method is to make a copy of the hard drive in the lab but in the case of volatile computer evidence it may be necessary to collect some evidence at the scene. With volatile evidence the first step is to determine the operating system and note the date and time. Next the investigator will dump the RAM from the system to a removable storage device and then check the system for the use of whole disk or file encryption (Shipley & Reeve, 2006). A copy of the volatile operating system data will be made as well as a copy of portable storage devices.

During the evidence collection process you cannot simply make a copy of the hard drive on scene and then release the computer back to the owner. The reason for this is the computer contains the original evidence needed to be presented to the court to authenticate the evidence located on the computer. Secondly the original computer is needed in the event the defense request the original evidence in which to conduct forensic tests. A copy is made of the hard drive of the computer in order to ensure the original evidence in the computer stays the same so it can later be authenticated in a court of law.

In the state of Mississippi child pornography is a crime and a felony. The state has taken a harsh stance when sentencing these offenders. Anyone caught with pornographic images of a child will face up to twenty years in prison. This law includes acts of sexting by youths because currently no sexting law exists. Once the person found guilty of the crime of child pornography leaves ail they will be forced to register on the state sex offender registry for the remainder of their lives.

References

National Institute of Justice. (2010). Digital Evidence and Forensics. Retrieved September 7,

2014 from http://www.nij.gov/topics/forensics/evidence/digital/Pages/welcome.aspx

Shipley, T. & Reeve, H. (2006). Collecting Evidence from a Running Computer: a Technical and

Legal Primer for the Justice Community. Retrieved September 7, 2014 from

http://www.search.org/files/pdf/collectevidenceruncomputer.pdf