Computer Forensic Specialist Challenges

As technology has advanced, so too have the problems facing today's computer forensic specialist.

As computers and digital gadgets have become more sophisticated, so too have the challenges faced by computer forensic specialists in recovering data from them. Whether it is the greatly improved storage capacity of electronic memory devices or rapid advances in digital encryption software, one thing is clear: The problems facing computer forensics are not going to get any simpler.

Background

In the 1990s, most computer forensic work involved single computers. An investigation often took less than 40 man-hours to complete, according to computer forensic specialist Sean McLinden in an interview with Forensic Focus. With the rapid advance of computer technology, and the introduction over of new digital media such as cameras, voice recorders, cell phones and laptop computers, modern computer forensic investigation has evolved into a far more complex science.

Networking

Computer systems have become more complex and are often linked to hundreds, if not thousands, of other computers worldwide via private networks or the Internet. These distributed networks cause problems for forensic specialists who may have to track data over many computers. Computers involved in an investigation may not even be located in the same country where the investigation initially begins. An investigation may start on a computer located in the U.S. but may quickly lead to other computers located in Europe or elsewhere in the world–possibly even in countries where U.S. law has no jurisdiction.

Legal Hurdles

The Electronic Communications Act is a U.S. law first enacted in 1986 to extend protection against unlawful wire tapping into the realm of modern electronic data transfer and storage. The law includes protection for Internet service providers, which can prove to be a serious hurdle to a forensic investigation, McLinden said, because it stymies the ability of private sector investigators in retrieving data. “One of the biggest challenges facing computer forensics professionals, especially in the US, are misguided attempts to protect consumers through state licensing requirements,” McLinden said.

Storage Media

As technology has advanced, computer memory storage media has grown smaller and cheaper while the storage capacity of these devices has grown substantially. Coupled with an increase in the sophistication of widely available computerized privacy tools and encryption software, this advancement is creating far reaching effects for forensic specialists, according to McLinden. “These and other systems for encryption and obfuscation can make it very difficult, if not impossible, to extract information in a time sensitive manner,” he stated.

Foreign Outsourcing

The trend of businesses outsourcing work to cheaper, and often less security-conscious call centers, application hosts and customer organizations based in foreign countries, has also caused headaches in the retrieval of evidence for computer forensic specialists. McLinden states that these overseas based businesses are often outside the reach of U.S. law, making it next to impossible to pursue and prosecute those involved in crimes.

Technological Advances

According to Paul Wright, a forensic specialist with the City of London Police, the continual advancement of technology, while a boon for the majority of society, will cause problems for those involved in computer forensics who fail to keep abreast of advances. “If we do not invest in the skills necessary to police this ever-changing environment we will have to contend with playing 'catch-up' in understanding how new technologies are associated with traditional and new crimes,” he said in an interview with Forensic Focus.

References

• Forensic Focus: Interview With Sean McLinden
• Expert Law: Computer Forensics 101
• Forensic Focus: Interview With Paul Wright, City of London Police