Hello All,
This is my first topic on this forum and I would like some thoughts on the future of computer forensics.
1. Methodology. Are there any methodlogies that are under development/introduction? Will ACPO good practice guide be reviewed in the future?
2. Handheld devices. With the emergence of PDAs, mp3 players, 3G phones, how is computer forensics being affected? Are the technology and tools adapting equally to this rapid change?
3. Future for law enforcement. Is the legal framework adequate to cope with demands? Is juristiction an unpassable obstacle?
4. Forensics Tools. Is there any tool that can recover data from forensically-safe cleansed storage media? Is this possible in any way?
It would be great if anyone can spare some time to answer those questions or simply show me the path to take to answer those questions myself!
yiola,
Good questions all and current issues as well. I can speak to three of your four questions. As for #4, I don't believe that I have seen anything on this subject yet.
1. Methodology - The ACPO guide is as good a start as any. I believe that you should consult as many guides as possible and determine from your perspective which items are most relevant. Some things will apply and some won't. You can create your own checklists and verification processes as you gain more experience in the field.
2. Handheld devices - The response by industry, law enforcement and training organizations to increase the level of proficiency by investigators in examining these devices seems to be on track with the rate at which new ways are found to use these devices for nefarious acts.
3. Future for law enforcement - So far as I can tell, the legal framework seems adequate. It will take some work to educate LE personnel on what should be included in requests for search warrants and so forth.
4. Forensics Tools - If it has been "forensically-safe cleansed", does it not follow that NO forensic tool can extract data? I understand that "forensically -safe" indicates that no errors were made in the cleansing of the device or media and that nothing short of statistical analysis magnetic patterns on such device or media would be required to even make assumptions as to what was previously held.
Cheers,
K