Hard Disk Forensics expertise?

Moonliner · 09-25-2007, 01:42 PM

Has anyone round here worked with hard disk forensics in relation to legal actions?

I'm looking for information not on the technical side of the equation but rather on the rules, procedures and certifications that are needed in the legal world.

Is there a nationally recognised certification for individuals performing hard disk analysis?

Are there set procedures to secure chain of custody, etc...

Thanks for any help.

Ps: No I'm not facing any legal action, It's for a friend. No really it is.

€uroMeinke · 09-25-2007, 01:57 PM

Usually going to forensics only happens in extreme circumstances - where a party is presumed to have deliberated deleted or altered their hard drive to cover up illeagle activity or fraud.

Usually it happens after hardware is siezed in a legal action and the chain of custody falls on the organization doing the seizing. There is no set standard, and usually the effort is proportional to the severity of the case but might include: witnessed testimony, access control logs, documented and audited processes (if this is an organization we're talking about).

To my knowledge, there is no certification standards for forensics, tbut there are a number of private companies (as well as government organizations) that specialize in these activities to different levels complexeity - Apparently the CIA has technology that can read back 7 re-writes of a hard drive.

I guess a lot depends on the circumstances:

Is your friend trying to find evidence of wrong doing on someone else's computer? And if so, is criminal procsecution an expected outcome?

Or is your friend trying to cover something up that may be on his computer?

€uroMeinke · 09-26-2007, 08:50 AM

Your friend might find this article of interest

Alex · 09-26-2007, 09:09 AM

There are professional certification programs out there for computer forensics that are supposed to help with getting work with law enforcement agencies and certain private industrial applications.

But I don't know any of the details.

09-25-2007, 01:42 PM	#1
Moonliner 8/30/14 - Disneyland -10k or Bust. Join Date: Jan 2005 Posts: 9,022	Hard Disk Forensics expertise? Has anyone round here worked with hard disk forensics in relation to legal actions? I'm looking for information not on the technical side of the equation but rather on the rules, procedures and certifications that are needed in the legal world. Is there a nationally recognised certification for individuals performing hard disk analysis? Are there set procedures to secure chain of custody, etc... Thanks for any help. Ps: No I'm not facing any legal action, It's for a friend. No really it is. __________________ - Taking it one step at a time.
	Submit to Quotes

09-25-2007, 01:57 PM	#2
€uroMeinke L'Hédoniste Join Date: Jan 2005 Location: A.S.C.O.T. Posts: 8,671	Usually going to forensics only happens in extreme circumstances - where a party is presumed to have deliberated deleted or altered their hard drive to cover up illeagle activity or fraud. Usually it happens after hardware is siezed in a legal action and the chain of custody falls on the organization doing the seizing. There is no set standard, and usually the effort is proportional to the severity of the case but might include: witnessed testimony, access control logs, documented and audited processes (if this is an organization we're talking about). To my knowledge, there is no certification standards for forensics, tbut there are a number of private companies (as well as government organizations) that specialize in these activities to different levels complexeity - Apparently the CIA has technology that can read back 7 re-writes of a hard drive. I guess a lot depends on the circumstances: Is your friend trying to find evidence of wrong doing on someone else's computer? And if so, is criminal procsecution an expected outcome? Or is your friend trying to cover something up that may be on his computer? __________________ I would believe only in a God that knows how to Dance. Friedrich Nietzsche
	Submit to Quotes

09-26-2007, 08:50 AM	#3
€uroMeinke L'Hédoniste Join Date: Jan 2005 Location: A.S.C.O.T. Posts: 8,671	Your friend might find this article of interest __________________ I would believe only in a God that knows how to Dance. Friedrich Nietzsche
	Submit to Quotes

09-26-2007, 09:09 AM	#4
Alex . Join Date: Feb 2005 Posts: 13,354	There are professional certification programs out there for computer forensics that are supposed to help with getting work with law enforcement agencies and certain private industrial applications. But I don't know any of the details.
	Submit to Quotes