BlueWolf's Howl

« Sometimes it matters... | Bluewolf's Howl | Trade Magazines »

June 07, 2005

Computer Forensics

Investigating things can be fun and exciting. The popularity of the crime shows on tv are a testament to the human draw toward solving the mystery. But, there are some times when you really should call in a specialist. Investigating computer crimes is one of those times.

From Network Computing (a very old issue):
Using a forensic investigator makes it less likely you'll be accused of evidence-tampering, in the same way that an independent accountant can reduce the risk of an audit. Even a well-intentioned member of the IT staff can alter the findings of an investigation in a misguided attempt to prove guilt.

Consider a recent case of wrongful termination: An employee of a Fortune 500 company was fired for using the Internet to view decidedly inappropriate content in violation of company policy. In attempting to investigate, IT employees found 'evidence' of a crime that would escalate the prosecution to a federal level, prompting the hiring of an investigator to verify the findings.

As it turned out, the 'evidence' had actually been generated by the untrained IT workers in their attempted investigation. They had opened Internet history files on the live system to verify contents, which generated new cache files for Internet pop-ups and Web sites that contained the evidence in question. So, in fact, the evidence they were using to prosecute the former employee had been generated by the people tasked to investigate the incident!

Not something you normally think about is it?

Posted by BlueWolf on June 7, 2005 10:02 PM