The recovery and examination of material found in digital devices, including deleted files and file metadata. The 2005 arrest of BTK killer Dennis Rader followed the recovery of identifying metadata embedded in a Microsoft Word document he had sent investigators on a floppy disk. This description is adapted from Wikipedia contributors under CC BY-SA 4.0; changes were made. https://creativecommons.org/licenses/by-sa/4.0/
Facts
What It ExaminesData recovered from computers, storage media, phones and networks, including deleted files, file metadata, communications and activity logs, preserved and analyzed for use as evidence. 1 Formalized YearDated to the FBI's Computer Analysis and Response Team, an early institutional formalization; the discipline itself developed gradually rather than on a single date. Known LimitationEncryption is a major constraint on examination: it can prevent investigators from locating pertinent evidence by keyword search or from accessing a device at all. 2 Discipline
Discipline (category) Connections
Associated With
A computer itself is a source of evidence in cybercrime investigations, the province of digital forensics.
Source Wikipedia: Cybercrime
Cases Where Used
Metadata recovered from a floppy disk identified Dennis Rader in 2005.
Source Wikipedia: Dennis Rader
Digital forensic examination of Ross Ulbricht's seized laptop, including an in-use unencrypted session, produced much of the evidence at trial.
Source Wikipedia: Silk Road (marketplace)
Examines Within
Sources
1. Saferstein, Criminalistics: An Introduction to Forensic Science
Richard Saferstein, Pearson
2. Digital Forensics (Wikipedia)
Branches section, Computer forensicsQuote, Branches section, Computer forensics
The goal of computer forensics is to explain the current state of a digital artifact; such as a computer system, storage medium or electronic document.
Wikipedia: Dennis Rader
Surveillance of Rader section
Police found metadata embedded in a deleted Microsoft Word document that was, unknown to Rader, still stored on the floppy disk.
- Cases Where Used: BTK Case
View the SourceWikipedia: Cybercrime
Associated With: Cybercrime, Law-enforcement sectionQuote, Associated With: Cybercrime, Law-enforcement section
a computer can be a source of evidence (see digital forensics)
Wikipedia: Silk Road (marketplace)
Reader Challenges (0)
No disputes yet. Spotted an error or a better source? Open the first one.
Sign in to dispute this or suggest a correction.