Benefits of Forensic Readiness to a Company

Benefits of Forensic Readiness to a Company

Digital forensics is a field that deals with investigations of law enforcement that might end up in the court. It uses a computer information system. The digital evidence is volatile. It should be handled and preserved in a manner that will not be distorted.it can be used to gather information. Evidence to be used by an organization against a person also can be used to retrieve lost data

Forensic readiness minimizes the cost of investigations: evidence gathering, as well as disruption of operation, is minimal. (Karume,2017) The information is already gathered by forensic readiness; the investigator is required to analyze and review the network logs. Makes investigations faster and effective also reduces the adverse of interrupting the employees’ work.

SECTION I: list of people to be interviewed and stages of interview settings: A list of people to be interviewed include: Ms Evelyn Bass to give any information about how he conducted his work because she was under his supervision.

Ms Victoria to give any other information apart from the thumb drive. Information about where Mr Belcamp stays, for the police to search.

During an interview, the settings are one of the strategies to consider success. Before phone interview, eliminate a disruptive environment to make calls, use a reliable clear and sounding phone, have a notebook, and a pen for taking note. During the call, do not use a speakerphone, one he required to speak loudly and slowly, conclude the request with an expression of interest.

The importance of setting the interview include (Fontana,2016) help select the right people for the meeting, the employer can collect the complete information about the job seeking. Discussion helps the interviewer to obtain full details about the candidate as the application form may not contain all of them.

SECTION II

QUESTION 1. summary report to the laboratory on digital and non-digital evidence to search: Digital evidence includes the flash drive, two hard disk, second flash in his laptop. The information contained in the four discs might have been used to transfer essential data such as passwords, encryption keys, source code of the software, and employees’ personal information. The flash-enabled the data to be transferred to other devices. The digital evidence should be kept away from magnetic fields. On-digital items include the folder on the top of the shelf of the disk, the screwdriver the sticky notebook on the underside of the computer monitor. The hard disk drive would be used to remove the hard drive from the computer, and the diary might have some notes.

QUESTION 2. locations to search outside Mr Belcamp’s place of job also police places to search: Other places for search include his phone and laptop to see any photographs. Police place of search his Mr Belcamp’s house, including the bedroom, to check any stored digital and non-digital evidence like files and books.  Involving police in the search, they will have to analyze every single element of the case. It will take more time to solve the case due to lengthy procedures and many considerations. The process of investigation will be slow. The police will lead to a loss of authority because they will establish their investigative rules and procedure to follow. The evidence that has taken the company time to assemble will be distorted because the police will not be convinced easily that the proofs were acquired legally

Chain custody refers to a form that is detailed and contains preserved records and evidence in investigating a case. It acknowledges the people who composed and organized for the evidence when the investigation was done.

The importance of the chain of custody includes: it preserves the evidence that is used during the investigation. It ensures that the evidence is out of reach to illogical persons that might distort the evidence. Signing the chain of custody and documenting it is very important.

QUESTION 3: EMAIL

FROM: Mr Stephen Bishop

TO: Ms Carol Mc Pherson

REF: DAUBERT STANDARD TOOLS TO IDENTIFY RECOGNIZE IMPORTANT FORENSIC READINESS

Daubert standard tools;

Tools                          manufacturer                       Capabilities

Encase                          Guidance software          provides a framework to conduct investigation

Forensic toolkit              Access data                  used to examine electronic media

Sleuth kit                       window-based                  help to analyze disk images

Importance of forensic readiness, Forensic readiness also proves that a company is a law-abiding corporate citizen. Thus, many customers will invest in the company. Customers prefer dealing with a company that is approved and recognized by the government. Forensic readiness is evidence that the company complies with the laws.

Forensic readiness promotes a sense of belonging among the employees; thus, the worker knows that a forensic readiness plan is monitoring any action taken. Furthermore, it facilitates the maintenance of digital evidence that is stored and retrieved when the employees misbehave in the workplace.

QUESTION 4. Steps to make prior to making an image of the document: When taking the thumb drive, take a photograph by using personal protective gloves, place the disk in the faraday bag, seal the bag with corresponding evidence number label.

QUESTION 5: what is hash value how to identify the code using hash value? A hash value is a specific length used in the calculation of the hash algorithm. It is used in digital forensic to calculate and verify data that has not been altered. In order to get the project x, the hash value is first of all computed afterwards compare it with the hash values in the database. When the hash value is found in the database, the examination is conducted to compare the thumb drive with that in the database. Afterwards, he would check the hash value that has been placed. The database might contain the hash value that is known in the thumb drive, thus, arriving at identification of the code. (O’Donnell, 2019) The process of hash value calculation starts with storing the hash value in the digital storage medium then securing the data and calculating the hash values, the secured data verify the hash values is the investigated by comparing it with the hash values in the database. Hash value addition application in digital forensic include integrity checks to detect accidental changes.

QUESTION 6. Are private companies required to report the crime to law enforcement? After getting the information from the laboratory examination that Mr Belcamp has stolen the project x code private company are not required to report the criminal law enforcement because they are non-governmental entities The company is a private entity on its own and is allowed to carry out personal searches to its employees for valid reasons. Belcamp’s expectation of privacy is objectively unreasonable.

QUESTION 7. Proves to ensure that the source code has been send to Mr Belcamp’s: this includes checking the email to identify the actual sender, recipient and time the email was sent also identifying and investigating the port scanning the metadata that identifies the email crimes and scams.

QUESTION 8: importance of qualified expert ad how it is different from simple fact witness. Expert witness helps one to prepare for a trial, also reviewing evidence, interview the witnesses, and understands the importance of the electronic device. (Collie,2018) Being a qualified expert witness was important in the case because the laboratory examiner was a medical scientist who had DNA evidence of the thumb drive. The simple witness cannot give options while the expert witness gives options. An expert witness is qualified, but the simple witness does not have.

QUESTION 9: summary of the report requested by the Attorney general to how the examination work is accepted by the court: When doing the analysis on the thumb drive, the hash value was used to compute the sample and after comparing it with that in the database the results turned positive. The digital evidence in the thumb drive was stored in a medium to prevent distortion before the calculation of the hash value. He repeated the procedure severally to arrive at an identification.

Finally, when chain custody is not documented, the essential proof gathered will be useless. The expenses the company incurred when gathering information will be unnecessary. Thus, a company must document and ensures that the chain of custody is upheld and established. The two vital requirements for forensic readiness in the business sector are: identify incidences that require demand digital evidence. Secondly, draft a firm policy that guarantees maximum security for digital prove.

Reference

Collie, J. (2018). A Strategic Model for Forensic Readiness. Athens Journal of Sciences, 5(2), 167-182.

Fontana, A., & Prokoss, A. H. (2016). The interview: From formal to postmodern. Routledge

Karie, N., M., & Karume, S. M. (2017) Digital forensic readiness in organizations: Issues and challenges, Journal of Digital Forensics, Security and Law, 12(4), 43-51. DOI:https://doi.org/10.15394/jdfsl.2017.1436.

O’Donnell, R. (2019, February 26). The case for an employee handbook acknowledgment form. Zenefits. Retrieved from https://www.zenefits.com/workest/employee-handbook-acknowledgment-form/.