Forensic specialists may encounter different protection systems for data access. The most common and simple system of protection is compressing archives by a password. At present, ZIP and RAR are two most commonly used archive managers. Russian archive manager (RAR) has a stronger encryption mechanism (AES-128 standard) which implies 128 bits encryption. This archive manger […]

Like any other new scientific discipline, computer forensic has been gradually developing into generally accepted method for determining the origin and validity of digital evidence.

Basics of computer forensics Computer forensics is the application of computer investigation and analysis techniques in the interest of determining potential legal evidence. Evidence revealed through forensic methods may be used in various investigations: civil litigations: divorce, harassment and discrimination companies seeking evidence of abuse of position or authority, embezzlement or theft of intellectual property […]

In some cases, evidence needed or required for criminal investigation is stored on the hard disc duly distributed and marked, with characteristic names and extensions on appropriate locations.

There are three basic data destruction methods: OVERWRITING Nowadays, there is a great collection of commercial software that destructs data by overwriting. Although even Windows XP operating system has a tool (cipher.exe) for overwriting of free space, encryption and decryption, there is a good reason why only a few of top quality software managed to […]

Acquisition of digital evidence begins when information and/or physical items are collected or stored for examination purposes. The term “digital evidence” implies that the collector of evidence is recognized by the courts. The process of collecting is also assumed to be a legal process and appropriate for rules of evidence in that locality. Although rules […]