Thesis on "Digital Forensics"

Thesis 8 pages (2402 words) Sources: 10 Style: APA

[EXCERPT] . . . .

Digital Forensics Technology:

Why Open Source Forensic Software Is a Significant Development

Of the many new technologies introduced into digital forensics in the last five years, open source forensic software has been the most significant in its contributions to forensic analysis, the prevention and solving of crimes. Open source forensics software is today being used for the identification of unauthorized access, the presentation and analysis of access points and capturing of a cybertrail that can be used as evidence in U.S. Courts

(Volonino, 2003). This is significant as open source software was initially perceived by the broader it community as lacking the security, reliability and support for proprietary software (Muller-Seitz, Roger, 2009). Despite this reputation however adoption continues to outpace that of proprietary software over the last three years. Enterprise software companies including Microsoft, Oracle, SAP and others have specifically developed extensions to their own applications to capitalize on the economic benefits and rapid pace of innovation open source software provides. These are the same dynamics that are serving as the catalyst of rapid adoption and continual innovation of open source forensic software. The intent of this analysis is to evaluate why open source forensic software is important, how it is proving to be useful to corporations and law enforcement in fighting and in some cases alleviating computer crime, and how its use supports the three steps of gathering digital evidence. Included in those three steps are approaches to acquiring, auditing, authenticating and analyzing the digital evidence so it can be used in a court of law.

The Increasing Importance of Open Source Forensic Software

The escalating rate of computer-based crime in the form of agents, Trojan viruses, and bots and automated Web Services that seek to capture personal information online and also gain access to secured banking, financial services, and military installations is growing at an exponential rate. The rate of growth of these threats is surpassing the ability of securities agencies and software firms to counter them (Abel, 2009). Amid this rapid growth of all forms of Internet-based crime, there have been only partially successful attempts from the leading software securities firms to alleviate this problem (Erickson, 2009). Ironically, proprietary software is not scaling as fast either from functionality or a market adoption standpoint to keep up wit h the onslaught of security weaknesses throughout the myriad of process workflow areas of the Web and its many banking, e-commerce, financial services and government sites. Open source forensic software, despite the criticisms of security, reliability and support (Abel, 2009) continues to be more agile as a development platform in responding to these threats. Open source forensics software has then progressed from fad to enterprise-wide application solution as a result (Rogers, 2003).

Open source forensics software also has a significantly lower Total Cost of Ownership (TCO) and a rapidly expanding base of development support which also combine to create an exceptionally strong catalyst of faster innovation as well (Bates, 1997). For budget-constrained companies, municipal, state and federal organizations, this lower TCO of open source software has been one of the business drivers favoring its adoption. The perceived vulnerabilities of open source, specifically it support of security standards common across digital forensics (Forte, 2008) has been validated through a series of performance audits (Irons, 2006). These have shown that open source software is just as secure as proprietary software and in some cases, even more so given the selection of configuration management selections by programmers in the coding and completion of the open source forensic software.

More fundamentally however, open source forensic software has shown the ability to scale from an architectural standpoint to support the rules-based approaches forensic analysis requires to support the digital evidence gathering process (Berghel, 2003). The basis of forensics software is a series of constraint and rules engines that seek to define the optimal path of evidence to a valid conclusion (Bates, 1997). Depending on the design philosophy of the forensics software the entire application could be based either on rules-based engines or constraint engines (Irons, 2006). It is rare to find one that mixes both rules and constraints, as this would require modeling of each actual scenario being investigated. The majority of forensics software is rules-based where each aspect of the digital evidence gathering process is defined as a set of conditional statements (O'Connor, 2005). These rules do not vary from one application to another, there are specific logic workflows defined and applied across the entire spectrum of digital forensics applications and tools. As a result, there is little if any variation in the security and reliability of open source forensics applications. Both private and public organizations including municipal, state and federal agencies, in their due diligence of evaluating open source forensic software consider this factor in conjunction with TCO analysis and determine that the price/performance of open source-based applications makes sense for their needs. The fact that training and continual development expertise is needed is certainly a factor, yet with the lower TCO and the broader community of development teams makes this more affordable compared to proprietary forensics software (O'Connor, 2005). In many instances larger organizations will license the source code and complete their own customizations, a process that would be quite expensive with proprietary software as well. This customization of open source forensics software to the precise needs of any given organization or government agency would be cost prohibitive with many of the proprietary software companies (Erickson, 2009).

All of these factors are contributing to the development of enterprise information assurance programs (Barbin, Patzakis, 2002). These programs are comparable in scope to enterprise compliance and quality management programs that rely on content management systems. Open source forensics software is moving from being an investigative tool to a compliance platform (Irons, 2006) and as a result is taking on the characteristics of content management systems as a result. Inherent in the design of the most advanced open source forensics software applications is support for enterprise-wide assurance programs that include their own databases, evidence management systems, audit features including the preservation of cybertrails captured electronically and recovery routines for records potentially lost from illegal activity. In short, open source forensics software is also acting as a catalyst for the development of enterprise-wide security platforms that can manage the entire scope of security workflows within organizations, government and federal systems (Irons, 2006). This is significant in that the databases that form the foundation of these systems now support access- and role-based taxonomies that can be used for analyzing trends in both authorized and unauthorized access to systems. The preservation and identification of these audit results, often called a cybertrail (Irons, 2006) is admissible as evidence in U.S. Courts as well (Volonino, 2003). Use of open source forensic software for electronic recovery and retention of electronic records that were compromised is also achieved through the use of the rules-based approach to verifying and validating their source and recovery (Barbin, Patzakis, 2002). The emergence of the enterprise information assurance programs and the support for enterprise compliance and quality management from a security standpoint illustrates how state-of-the-art open source forensics software is becoming. It is anticipated that within the next five years this progression of development will result in Service Oriented Architectures that include Web Services to automate these processes over secured Internet connections. To counter the exponential levels of threats that are occurring that seek to steal intellectual property and personal information, the developed of SOA platforms for compliance and Web Services is a necessity (Abel, 2009).

In conclusion the catalysts that are driving the rapid adoption of open source forensic software are going to accelerate in the next give years as organizations and government agencies seek to define compliance as a deterrent strategy, while also continually refining the audit process of how electronic access to systems is used. Through the use of rules-based logic workflows in open source forensics software is also going to lead to more use of predictive analytics to anticipate when illegal activity is about to occur and then thwart it through controls and the use of redirects. All of these advanced innovations will be made possible due to the broad base of support that open source software has generated in the digital forensics industry over the last five years and will continue to fuel into the future (Abel, 2009).

How Open Source Software Supports the Digital Evidence Gathering Process

The three steps of the digital evidence gather process of acquiring, authenticating and analyzing evidence all (Irons, 2006). Beginning with the acquisition process of digital evidence, open source forensic software's reliance interpreting and identifying unauthorized access to systems and the ability to audit each of these attempts to a quality level that is consistent with ISO Standard 15489:1 is essential for its use from a verifiability standpoint (Irons, 2006). Second the acquisition phase includes the capture of all forms of digital evidence with an emphasis on auditable activity over the Internet in the form of unauthorized attempts to gain access to systems and sites.… READ MORE

How to Reference "Digital Forensics" Thesis in a Bibliography

Related Thesis Papers:

Digital Forensics Research Paper

Cloud Computing Digital Forensics

The pace at which technology develops in today's world makes inventions and discoveries very temporary and short-lived. Digital forensics is an area of technological development that… read more

Research Paper 4 pages (1273 words) Sources: 4 Topic: Computers / IT / Internet

---

Digital Forensics: Issues and Developments Case Study

The regional teams has to work with the U.S. Secret Service and gather evidence to create forensic pictures and to analyze that data with a particular network of computers known… read more

Case Study 4 pages (1284 words) Sources: 4 Topic: Computers / IT / Internet

---

Digital Evidence Forensics and the Law Research Paper

Forensics

Digital evidence/forensics and the law.

Digital Forensics

"How does Carrier's (2005) digital forensics process of preservation, isolation, correlation and logging (PICL) compare to the United States Department of Justice's… read more

Research Paper 12 pages (3398 words) Sources: 10 Topic: Crime / Police / Criminal Justice

---

Computer Forensics Computers Data Analysis Chapter

Indeed, many people have active disdain for laws regarding national security and state secrets. Some go so far as to say that there should be nothing withheld from the public… read more

Data Analysis Chapter 4 pages (1280 words) Sources: 2 Style: APA Topic: Computers / IT / Internet

---

Incident Response and Computer Forensic Investigation Research Paper

Computer Forensic investigation

Making an initial assessment about the case.

Identifying the risks.

Mitigating or minimizing the risks.

Determining a preliminary design or approach to the case.

Creating a detailed… read more

Research Paper 12 pages (3228 words) Sources: 7 Topic: Computers / IT / Internet

---

View 100+ more related papers  >>