State of the Art of Digital Forensic Techniques

Digital forensic standards have been developed that apply to the collection and preservation of digital evidence and they differ depending on the scene, nature and type of evidence being handled. For the successful prosecution and admissibility in court, certain accepted procedures have to be properly followed. Digital forensic examiners use different methods and tools to accomplish the same job during digital investigations and with the changing world of digital technology these tools and methods are variable to change. This paper analyzes and discusses the state of the art of digital forensic techniques as they are currently being used in the industry. Using the digital forensic process as a recognized scientific procedure, the paper looks at techniques applied in the acquisition and analysis phase. I. INTRODUCTION Once an attack has occurred and a system or network has been compromised, it is essential to be able to sift through the evidence of what has happened. From a technical information technology perspective, this means knowing how to find, recognize, and locate the visible evidence of the crime. From a law enforcement perspective, this means knowing how to handle the evidence to make sure it is admissible in court [1]. A good investigator also needs to know the technicalities of where and how evidence can be located. Without the ability to reconstruct accurately what has been done, crucial evidence may be subject to question. More importantly, the qualifications of the digital forensic examiner can become an issue if the processing of the computer evidence was done haphazardly [2]. The digital forensic examiner has to use certain digital forensic techniques in order to conduct a digital forensic examination.