Computer Forensic History

Australian Federal Police 1989/1990;

http//en.wikipedia.org/wiki/Electron_(computer_hacker)

Timeline from wiki;

http//en.wikipedia.org/wiki/Timeline_of_computer_security_hacker_history

Also;

http//en.wikipedia.org/wiki/Julian_Assange

When I joined the OFT, I was taken to a cupboard full on brand new unused VOGON kit and genuinly considered keeping it if ever a museum of forensics was opened, but then went all sensible and scrapped the lot.
No doubt that Encase 1 was a milestone in the development of IT forensics and perhaps those of us that had to look at data without such great tools can be regarded as "old school" even though it was only very recently in the scale of things

Happy memories when SAFEBACK was the imaging King

When I joined the OFT, I was taken to a cupboard full on brand new unused VOGON kit and genuinly considered keeping it if ever a museum of forensics was opened, but then went all sensible and scrapped the lot.
No doubt that Encase 1 was a milestone in the development of IT forensics and perhaps those of us that had to look at data without such great tools can be regarded as "old school" even though it was only very recently in the scale of things

Happy memories when SAFEBACK was the imaging King[/

I remember using Safeback to image hdds to floppies and a bit later to Zip disks. There also were these floppy imaging tools that came in set of two, called Anadisk and the other was Teledisk.

There is a good document about computer forensic history written by Ian Charters “The Evolution of Digital Forensics Civilizing the Cyber Frontier”. It tries to explain why it is so hard to find “start year” of CF.

It’s available from google

Best regards
Michal Kedziora

I was initially trained using Vogon equipment happily by that stage we were at least imaging to DDS tapes rather than CD-ROM (although there was only a thin film of dust on the CD equipment) and once or twice I had cause to use the floppy disk autofeeder, as it was still fairly common to find people with cases full of the damn things. Ah, the joys of GenX and GenText and lugging dual DDS imaging units around the countryside!

Clearly the birth of EnCase wasn't the start of computer forensics, but I think it could be said to be the start of a new era in its evolution. It enabled a far broader range of people and organisations to start engaging more cheaply and easily with the material available on digital media. Since then there has, of course, been a proliferation of commercial and open source tools.

I'd have to go with at latest 1984/85 as the case of Regina Vs. Gold & Schifreen was tried with computer evidence. I think that, in the UK at least, this was the first prosecution of a "Computer Crime" and thus is the start of the "Forensic" ( in the sense of presentation to court ) computer field.

But that's only the first case that I am aware of - I think that perhaps someone with better knowledge of the law might find one earlier !

I think it's a hard one to say someone's wrong, or really make a big deal about. Wasn't the first forensic computing course/degree in the UK the Cranfield one, some time around the millennium?
Surely it'll come down to subjective opinion and make little odds? Someone could have produced a document from a floppy disk on write-protect setting with printer drivers years ago, that's preventing modification of the evidence, and then served it in court.
If it's the application of accepted methods etc surely one could argue this was very much in the stage of being formulated till around the millennium.
I certainly wouldn't bother to argue the point in court unless there was some particular reason it mattered 😉

Clearly the birth of EnCase wasn't the start of computer forensics, but I think it could be said to be the start of a new era in its evolution.

Clearly this is an emotional debate, but I don't think that EnCase could claim to be a new era - automated tools for Forensic Analysis existed with "The Coroner's Toolkit" for UNIX in 1999 …

On the other hand, if you mean the start of the era of "point and click forensics where people no longer need to understand what they are doing", then perhaps I agree -P

Clearly the birth of EnCase wasn't the start of computer forensics, but I think it could be said to be the start of a new era in its evolution.

Clearly this is an emotional debate, but I don't think that EnCase could claim to be a new era - automated tools for Forensic Analysis existed with "The Coroner's Toolkit" for UNIX in 1999 …

On the other hand, if you mean the start of the era of "point and click forensics where people no longer need to understand what they are doing", then perhaps I agree -P

I agree with pragmatopian, the launch of EnCase was the start of a new era in forensics, though it wasn't the first analysis suite. Being 'first' to the market seldom means that you'll be the best or most successful or even widely remembered. EnCase was the start of the successful commoditisation of forensics and was soon accompanied by training courses, certifications, dedicated support and so on. Obviously this is a subjective matter, but I think a good argument can be made that the modern era of computer forensics does parallel EnCase's launch and development.

Saying that Encase is the start of Digital forensics is like saying the field of cookery began with the creation of the microwave.
D