What are the Roles of Computer forensic investigator? The dawn of computers accompanied tactful crimes conducted by “smart� individual who ideally erase any bit of evidence that could lead to their capture. Banks and personal account holders together with corporate have suffered immense financial losses in situations that specialists thought was strange until they discovered how the responsible culprits commit the fraud. It is as a result of such fraud and other computer related crimes including child pornography, hacking, espionage, cyber stalking among others that the need of Computer forensic investigators was born. As I mentioned earlier, individuals committing cyber crime tend to be smart in their undertaking and would take a much smarter investigator to trace their activities and present the evidence in a court. It is important to note that the accused is not always the culprit. A computer forensic investigator in any case carries out four principal tasks outlined below;
1. Identification With vast knowledge of computer forensics, computer programming, computer equipment and networks along with other relevant knowledge a computer forensic investigator would need, he/she is mandated to identify the possible device containing evidence of an alleged crime.
This will encompass, tracing past activities that the (suspected) devices were involved in, data analysis and eventually narrowing down to a prime device(s) which will be investigated in details to find out if any useful information can be retrieved. When it is possible after the process of identification, that the suspected electronic device could be harboring the evidence needed to convict or acquit the accused, a second step would be taken, and that would be;
2. The Extraction of evidence In most cyber crimes related cases, suspected culprits often try to destroy the evidence that would lead to their conviction. If the evidence was in a hard drive or a CD, they dismantle those media making it hard to retrieve the useful data stored. It is therefore, the work of a computer forensic investigator to rebuild the destroyed hardware and skillfully retrieve the intended data. In cases where the devices are sound, the expert will proceed to retrieve the needed information and moves on to the third stage of preserving the evidence. 3. Documentation/Preservation After the information (evidence) has been retrieved successfully, the investigator will document what he/she has found relevant for the case in hand during the process of extraction or rather preserve the important data to be used during trial. The computer forensic investigator is also mandated to interpret the supposed evidence in a form that can be understood by the jury. Additionally this would mean that he/she would decode encryptions and retrieve artifacts to enable the court to understand hidden or deleted information.
4. Presentation During the hearing of the case, the computer forensic investigator will present the found evidence to the jury proving that the accused is actually guilty or not guilty of the accused crime. In conclusion; It is important that an accused or defendant has a computer forensic investigator to assist during investigations of cyber crimes as this is necessary for an effective defense. Cases that need computer forensic investigation expertise includes; fraud, child pornography, espionage, murder or attempted murder, rape, hacking and cyber stalking among many others.
Institute of Computer Foresnsic Examinations and Criminal Investigations 4360 Western Center Blvd., #304 Fort Worth 76137 Texas USA Email: daniel_james@att.net Web Site:https: https://www.icfeci.com/services/