Interest in Computer Forensics - Essay Example

?Part Computer forensics has always interested me and though I have considered myself close to being an expert in computer science, I must admit I have had to concede that I have learned that one can do many illicit things with a computer; situations that I did not know existed. Yet on the same token the forensic investigators, “the good guys”, can counter these illegal operations with many sophisticated tricks of their own. Sometimes it is not as instantaneous or glamorous as the fancy gadgets they show on CSI NY but they have many tools available to recreate crimes that can eventually hold up in court. But the TV shows have it right in at least one respect. Not only must the computer forensic evidence be understood by the jury, it must be "supported by appropriate validation” (Walker 2005) So that brings me to the new things I have learned in this course. Honestly WinHex was a software program I had never heard of. Yet from Week 3 onwards, I was able to download a demo copy of the program and we used that program to uncover many things. For instance in Week 3 itself, I was aware of the terms SHA, MD5, and checksum and had seen the codes many times over the years. Yet I had no idea they were used to examine two disks and determine if they were the same. Over the course of the next few weeks, we were given sample disks to examine for hidden and deleted files. In Week 3, we looked at a file to discover a word document and an Adobe Acrobat file. Although the Adobe file was damaged, with the professional copy of WinHex one could have possibly read it in due course. I was so enthralled with WinHex that I wished I had the full copy to actually fully use the tools available. When I researched that I was pleasantly surprised to learn the full software cost is only 195 Euros, or $252.51 under today’s exchange rates (2012). There were two things I knew something about prior to this course but had given little thought of. The first was the image file. I had used, and even created images, many times in my career. For example, my employer uses image files to execute software uploads, like building or rebuilding computer systems to deploy the operating system. Yet I also learned in Week 5 that the image file has a very important role in the forensics arena. If the investigator does not use the image process in his work, the original material could be damaged or destroyed. Without the original, there is no evidence and possibly no case. One can either use WinHex or several imaging and retrieval tools such as Towodo Software for this purpose. I had also heard of password cracking devices before but until I was attempting to find out information about the student cult in Week 5, I had always assumed they were only available to proper authorities, much like locksmith tools. The cult had an Excel file that was password protected. A little research revealed there are various commercial programs available for purchase which do just that, supposedly for the purpose of letting one in his own files! As far as nothing new from the lessons, I could not find any of them that I didn’t learn something. Computer science as a whole is a discipline where if one is committed to the process, it is a continuous learning experience, for new innovations far outpace the capacity of the human brain. Part 2 Almost every occupation has an organization dedicated to its betterment and computer forensics is no exception, for theirs is The International Society of Forensic Computer Examiners (ISFCE). Among other benefits for members, ISFCE offers professional licensing as a Certified Computer Examiner (CCE) and also has training available worldwide (including Australia and Canada). According to their website, training is intense but well worth the effort put forth, for CCE certification is “one of the most desired certifications in the digital forensics industry”, ISFCE is recognized by the Veterans’ Administration as a legitimate training facility and has been recognized as an experience waiver (one year maximum), when it is combined with the Certified Information Systems Security Professional (CISSP) certification (2012).Another organization that certifies computer forensics professionals is the Global Information Assurance Certification (GIAC). They offer three different certifications, the first of which is the Certified Forensic Analyst (GCFA). The GCFA is the basic level and testifies the investigator is well-versed in forensics. Another, the GIAC Reverse Engineering Malware (GREM), enables the certificate holder to “hold the line” against malicious viruses and code. This works out well in the business environment as well as the law enforcement arena and is particularly valuable for systems administrators. The third is the GIAC Certified Forensic Examiner (GCFE). This person is most likely involved in law enforcement but could also be in the business world in security. Also, GIAC is recognized by the US Department of Defense under its DoDD 8570 Information Security Program (GIAC 2012). The main difference between ISFCE and GIAC is the latter requires no previous training but admits the exam process is extremely intense. Of course if one wishes to achieve higher education along with certifications there are many colleges and universities that offer advanced degrees in Computer Forensics, both online and resident courses. The discipline is fairly recent so not every college does offer the degree and instead pings it to the Criminal Justice degree. The online schools such as ITT, Walden and Kaplan all offer varying types of degrees in Forensics. Expect the training to be a pretty even mix of Computer Science (Operating Systems, Programming, and Software) along with several semester hours in law (Business and Criminal Law, procedures, ethics, etc.). All colleges offer those courses but it is the forensics specific courses most are still trying to develop (collecting and examining evidence forensically, software tools, and other courses). Time, expense, and difficulty are about on par with most other college degree pursuits (Learning Law 2012). References: GIAC (2012), Certifications: Forensics, Available at: http://www.giac.org/certifications/forensics. ISFCE (2012), Certified Computer Examiner (CCE), Available at: http://www.isfce.com/index.html. Learning Law (2012), Computer Forensics Degree, Available at: http://www.learninglaw.com/degrees/computer-forensics-degree/. Walker, Cornell (2005), Computer Forensics: Bringing the Evidence to Court, Available at: http://www.infosecwriters.com/text_resources/pdf/Computer_Forensics_to_Court.pdf. WinHex (2012), Online Orders, Available at: http://www.x-ways.net/order.html. Read More