System Forensics
1. What is Computer Forensics? System forensics is the process of systematically examining computer media as well as network components, software, and memory for evidence. System forensics involves collecting, preserving, analyzing, and documenting evidence to reconstruct user activities. Appropriately collected evidence is often presented in court to solve criminal cases and prosecute criminals.
2. How has technology improved the way criminal investigators perform their job? Technology improved the way criminal investigators perform their jobs by making it easier to track things, there is different types of software out there today to help them with these issues, and make the jobs easier, when you have different technology to help.
3. Why would a company report or not report a compromise case? The reason a company may or may not report a compromise because if it’s not in their favor and they may report it if it’s in their favor and vice versa. They wouldn’t want to look incompetent.
4. Who is in charge of labeling and securing sensitive information? The one in charge of labeling and securing sensitive information is the forensic specialist.
5. What is the Daubert standard? The Daubert Standard provides a rule of evidence regarding the admissibility of expert witnesses' testimony during United States federal legal proceedings.
6. Why would someone use a hex editor in a forensic investigation? The reason someone would use a hex editor in a forensic investigation is if the suspect has deleted files and has overwritten them on his or her hard disk, you can always use a hex editor to view any data stored in (or deleted from) both files and disk sectors. A hex editor allows you to peek at the physical contents stored on a disk, regardless of the boundaries of files, directories, or partitions.
7. What is the largest known data loss incident to date? The largest known data loss incident to date is Adobe Systems, Inc – 10-3-2013, 152,000,000
8.
2. How has technology improved the way criminal investigators perform their job? Technology improved the way criminal investigators perform their jobs by making it easier to track things, there is different types of software out there today to help them with these issues, and make the jobs easier, when you have different technology to help.
3. Why would a company report or not report a compromise case? The reason a company may or may not report a compromise because if it’s not in their favor and they may report it if it’s in their favor and vice versa. They wouldn’t want to look incompetent.
4. Who is in charge of labeling and securing sensitive information? The one in charge of labeling and securing sensitive information is the forensic specialist.
5. What is the Daubert standard? The Daubert Standard provides a rule of evidence regarding the admissibility of expert witnesses' testimony during United States federal legal proceedings.
6. Why would someone use a hex editor in a forensic investigation? The reason someone would use a hex editor in a forensic investigation is if the suspect has deleted files and has overwritten them on his or her hard disk, you can always use a hex editor to view any data stored in (or deleted from) both files and disk sectors. A hex editor allows you to peek at the physical contents stored on a disk, regardless of the boundaries of files, directories, or partitions.
7. What is the largest known data loss incident to date? The largest known data loss incident to date is Adobe Systems, Inc – 10-3-2013, 152,000,000
8.