Cyber Forensics: Development of a Case Hypothesis Essay

Throughout cadence past, forensic science disciplines have helped figure out numerous crime investigations and it has given impelling affidavit in the firmament of court trials. In order to reduce the sagacity of siding or bias accompaniment and avoidance in prosecuting innocent victims, it is important to analyse, bear out and have proper presentation of digital secernate in the background of cyber forensics examinations. 1 (Noblett et al, 2000) in this essay we exit discuss on various topics that describe, conthrough or illustrate on issues such as the soures that assist in the development of a case assumption and as surface as alternative hypothesis. It will too cover the processes in which how validation incumbrance and test are conducted to determine the accuracy of the digital evidence. Further more(prenominal), we will front into the deductive, inductive and abductive reasoning in the field of cyber forensics. Lastly, the essay will likewise cover on the proc esses that would improve the communication and presentation of case summary to the solicitors and courts.INTRODUCTION before the term cyber forensics was introduced in the late 1960s, most crimes are formally crystalized using traditional forensic science disciplines. onwards the first PC calculating machine was invented, crimes in those days were not as complicated as compared to today. In this introduction section, we will distinguish surrounded by what is forensic science and how it is different from cyber forensics. Forensic science depends on the force of the research scientists to develop a case answer for based on the outcome of a scientific review. For instance , a DNA report analysis of a murder case can be undertaken without the introductory knowledge of the victims name or exact situation of the crime.2 (Chakraborty, R.1990) On the contrary, cyber forensics sciences main focus is driven on information discovered during the investigation. However the challenge lies in the search go of valid and admissible evidence in the media storage of a computer. The ordinary storage capacity of a PC is approximately 300-500 Gigabytes at that placefore it is toilsome to totally scan through every single file stored on a suspects computer system, let al atomic number 53 those computer networks. 3 Casey, E. (2004PROCESSES THAT ASSIST TO DEVELOP CASE HYPOTHESIS /ALTERNATE HYPOTHESIS Before we develop a case hypothesis or alternate hypothesis, there are some(prenominal) procedures and guidelines that a forensic investigator essential deliver the goods and do. Firstly, the investigators must construct a hypothesis of the occurrence which is based on the study of the evidence. On the other hand, the degree of rigidity of this hypothesis besides relies upon the type of investigation. For instance, an Interpol police investigation would require the preparation of a elaborate hypothesis with discreet and meticulous proper documentation to support speci mens identify during the examination.4 Ciardhuin, 2004In the case of a police investigation , the hypothesis will be presented before a jury however the hypothesis drawn in a compevery will be handled by the management. Technically the hypothesis will be verified and an alternate hypothesis as closely as supporting evidence will be presented before a jury.The investigators will need to affirm the legitimacy of their hypothesis and protect it against any critics or provocation. In the event if the challenge is successful, there will be a need to backtrack to the earlier stages to collect and search for more evidences so as to construct a better hypothesis. Talking to the experts AKA warm tubbing is widely used for coexisting evidence. This process involves the court to put several expert witnesses on the stand together which will in loose saves much time and resources. Moreover, there are two main types of witnesses testimony at a trial, deposition or hearing. They are practiced or scientific witness testimony and expert witness testimony. 5Enfinger, 2006 As for technical or scientific witness, the investigator would need to present details of evidence that were discovered during the investigation. They would be asked to describe what was discovered and how it was acquired. During the compilation of the evidence, the investigator must ensure that the evidence collected must be legal and done appropriately with the permission of the owner and the suspect as well as a search warrant or hot pursuit.Also, it is essential that guiltless and inculpatory evidence is presented. 6 Cohen, 2006 On the other hand , the investigator would drawing out the trains of events that have certain connections and linkage to form the chain of custody which is basically a documentation or paper embroil displaying the seizure, control, transfer, analysis, custody and deposition of physical or digital. Apart from the chain of custody, there is another process known as the chain of Inference which is also referred as concatenate inferences. These inferences surrounded by the weak and the strong ones build upon one another until they reduce the gap between the defendant and the conclusion to a manageable distance. The concatenate inferences process may be interpreted by fabricating a hypothetical scenario. The purpose of constructing a chain of inferences is to convince a fact finder that the desired conclusion is the most plausible season of events. On top of this, it is also vital to internalise the difference between evidence and inference before the development of a hypothesis or the reconstruction of the crime scene.With that comes the formation of crime scene timelines which is an efficient manner to derive a conclusion. It is a graphical chart that illustrates the activity time line of crime scene sorted based on the season of events. These log entries displayed a unique chain of events that culminate in the attendant which is a closer step towards proving a case. 8 Stephenson, 2000 Another important process is testing, analysing and reporting. Testing is to ensure that all evidence both physical and electronic gathered must be verified and gone through role check by scientific personnel to affirm the originality without contamination as well as how this proof of evidence would be of any aid to solve the crime. Analysis deals with what are the issues identify and intention of the crime act and for for each one issue how it can be addressed, documented, tested and verified. Lastly this analysis will be written down and documented as a report. 9 Robert F. pull and Donald T. Campbell, 1969