Digital Forensics & Corporate Investigations

Corporate Investigations Increasingly Aided with Digital Forensics

Digital investigators can do more than retrieve data from devices. They can also use data to reconstruct past events to explain how computers were used to perpetrate wrongdoing.  Info4Security has introduced a new column, the Forensic Technologist, which will be written by Ernst & Young’s Simon Placks and explore how computer forensics are used to assist corporate investigations.

Computer forensic practitioners excel at reconstructing the past into a timeline. Like archaeologists, they excavate digital media and find the artefacts to evidence how that computer was used.

We’re very good at finding out how things occur and when (such as when a suspect downloaded pirated software, when sensitive data was copied to a USB stick or how a secure company database was compromised).

Take web search history as an example. You may not be aware that, even when periodically ‘flushed’, fragments of your Internet searches remain littered over the surface of your computer hard disk. Experts can ‘harvest’ these deleted fragments and produce a timeline of searches.

What does your Google search history reveal about you? What ailments are you afflicted with, where are you going on holiday – or perhaps more relevantly, how are you spending the proceeds of a crime? My favourite Internet search found on a suspect’s computer is: ‘How do I permanently delete stuff from my hard drive’.

Placks also explores surrounding issues:  For instance, he argues, in many ways the increased use of the cloud (centralized data) will make the lives of forensic experts easier.

Secrets are increasingly hard to keep in a digital world.