| |
 |
Newsletter - Winter 2008
The “Third Leg” of Computer Forensics
Charles Taylor, Manager, Advisory Services |
|
To describe computer forensics, I often use the analogy of a threelegged
stool. Those three legs are computer evidence, electronic discovery and data analysis. While each leg is separate from the other two, each is an important component of computer forensics. Seemingly, the least understood is forensic data analysis.
While we all analyze data, data analysis within the context of computer forensics has some unique features. First, forensic data analysis involves data related to a crime or litigation. Second, since both the scope and focus of an investigation almost always change, the data analysis requirements also change, sometimes dramatically.
Computer programmers and systems analysts are trained to gather all of a client's requirements before beginning to write a computer application. Once the requirements are established, the application is built to those standards, and changes can be very difficult, timeconsuming
and expensive.
Forensic data analysts, on the other hand, expect that analysis requirements will change as an investigation develops. Therefore, they use different techniques in designing their analytical pplications, with the prospect of change built in. They are experts at "going with the flow."
Forensic data analysts often find ways to accurately compare data in apparently dissimilar formats. In a simple illustration, customer data from one source may be formatted in three fields: last name = JONES, first name = FREDERICK and customer ID = 789345. Another source may provide similar data in a single field: (customer = Frederick Jones #789345). Data from one of these sources must be manipulated into a format compatible with the other, but it is then possible to make accurate matches or comparisons.
Forensic data analysts also are skilled at constructing complex queries and utilizing sophisticated matching techniques to reduce volumes of electronic data to a meaningful number of records. In a recent engagement, for example, Rachlin professionals condensed three dissimilar files containing 1.5 million records into a single spreadsheet containing a compilation of the 1,000 records important to the case.
A true forensic data analyst is a skilled and experienced investigator, allowing him or her to become a partner in the investigation, not simply a technician processing data. This investigative experience is critical since the forensic analyst is often the only examiner with sufficient technical background to work with witnesses and others to obtain evidentiary data in a usable format.
The forensic analyst conducts interviews to determine how data was created and stored and how it can best be preserved and retrieved. He or she can also suggest additional data that should be acquired or other kinds of analyses that may be helpful. Finally, the analyst provides an easilyunderstandable
report of findings and how the findings were obtained.
Forensic data analysis is often the "hidden" leg of the computer forensics stool. Though not flashy and frequently overlooked, it can save time, money and frustration, in addition to providing better understanding of voluminous and confusing data.
|
|
|
|
