Canadian Criminal Law/Appendix/Model Examinations/Computer Forensic Analyst

Background

<be sure to check with judge on how much familiarity he or she has with basics of computers, may need to go into details about what a file and a directory are>

• Name / employer / duration of employment / current position
• employment on date of offence / on duty on day of offence

Qualification

• education and training in computers and computer analysis / name of program / time of education
• Any special training with respect to computer forensics / What is Computer Forensics?
• Go details of training:
  • name of course / where is it available / who developed it / standardized program
  • starting at first program, list all educational programs completed, including duration (hours/days)
  • whether training involved hands on work / circumstances of this hands on work / ability to confirm results / any supervision
  • Go through the analysis process involved
  • success in the course / any certification / by what organization / time and duration of certification / requirements to be certified / requirements to maintain certification
  • Any other relevant training
  • gave training / presentations on the topic
  • Admit Resume

• Experience
  • number of prior cases you have performed analysis upon / # of times you have been asked to give an opinion / # of times you have testified in court / # of times qualified (when and where)
  • documenting all prior evaluations / method of documenting / reviewed before court

Seek to have computer analyst qualified as an expert in _____

Review Tools, Methodology and Terms

• state of computer when you first receive it
• Software tools used (FTK, EnCase, etc) / purpose of tools / preservation of data
• types of files examinable on the hard drive
  • accessible documents, images, videos
  • inaccessible documents, images, videos (full or partial)
• what is necessary to recover inaccessible or deleted file
  • different ways files are deleted / what is preserved
• there are several programs and services to recover data (est. that it could be reckless to assume deleted files are gone for good)
• manner to make files unrecoverable / software programs that exist

Incident

Examination of a Computer

• gained access to a computer / where / from whom
• type of computer / serial number / peripheral equipment / likely age of computer
• state of machine when beginning / accessing the hard drive using EnCase or similar / reason for using EnCase or similar
• identify operating system being used

Contents of the Computer

• found any files that were relevant to the case
• types of files (pictures, videos, documents)
• contents of the documents
  • did you review the contents of the files / do the file names reflect the contents
• metadata and characteristics of the files:
  • hash values and names of files / number of files found / total size of all the files / length of videos
  • location of files found / directories / unallocated space
  • dates of created, modified, and accessed / comment on accuracy of times and dates / other ways of determining date they were downloaded, opened or deleted

Signs of User's Identity

• examined files for signs of who uses the account:
  • checked OS registry / registered owner’s name
  • user accounts enabled on OS / whether one user can put files in another user’s directories
  • images of persons or family members
  • internet browsing history (including log-in information)
  • documents with names on it
  • connection with web log-in accounts with a certain name

Signs of User's Familiarity with Computers

• consider whether settings of P2P software were modified
• other software installed on machine, software that is generally directed at advanced user
• signs of customized operating system, desktop, etc. / how much different did set up look from the default installation out of the box

Other Potentially Relevant Information

• details on the software packages installed on the machine
• details regarding OS installation (time and date, by whom)
• synchronization of computer's clock
• other software installed (file deleting software, chat programs, viruses, spyware, or other file sharing programs)