Central Washington University Digital Forensics Discussion

reply to post below

For as long as I can remember the date and time where of utmost importance to law enforcement.  Not all data collected will elevate to a police investigation, but all data collected has the potential to end up in court.  Every call for service that an officer is dispatched to has a time stamp.  Every note that a dispatcher places in a call sheet has a time stamp.  It was ingrained that everything needed to be documented because you never knew when something would be called to court.

A timeline is important to a computer forensics examination.  The critical pieces of information for data is “creation date, last accessed date, and last modified data [1].”  Any access to this data from the examiner can compromise all of the data that will be retrieved.  This is why the step of sterilization and making an image of the data your examining is vital.  Once the recovery process is started there are forensic applications that assist the examiner with keeping an accurate timeline.  Supporting documentation such as chain of custody form will assist in keeping the evidence recovered accurately distinguished on the timeline.  EnCase offers an automated timeline feature.

When attempting to document a timeline for web browsing X-Ways Trace can analyze internet history [1].  It advises when a user logs on and reports usage and e-mails received.  This will validate the times that the examiner located in his triage reporting and initial data recovery.

Witnessing testimony of various cases over the years the time is quoted by an officer or witness to add credibility to the facts that are represented.  A timeline constructed will assist the examiner in a “double-check” of what they have recovered, and it will assist law enforcement in the event that the examiners data recovered is need in a criminal case.