Cyber Forensics: Development of a Case Hypothesis Essay

Throughout succession past, forensic science disciplines have helped puzzle out numerous crime investigations and it has given impelling testimony in the subject field of court trials. In order to reduce the sagacity of siding or bias line and avoidance in prosecuting innocent victims, it is important to analyse, clear and have proper presentation of digital state in the mount of cyber forensics examinations. 1 (Noblett et al, 2000) in this essay we exit discuss on various topics that describe, pardon or illustrate on issues such as the deales that assist in the development of a case supposition and as hale as alternative hypothesis. It will in like manner cover the processes in which how validation dispel and test argon conducted to determine the accuracy of the digital evidence. Further more than, we will tincture into the deductive, inductive and abductive reasoning in the field of cyber forensics. Lastly, the essay will in any case cover on the processes that wo uld improve the communication and presentation of case abridgment to the solicitors and courts.INTRODUCTION out front the term cyber forensics was introduced in the late 1960s, most crimes are formally pull ind using traditional forensic science disciplines. ahead the first PC information processing system was invented, crimes in those days were not as complicated as compared to today. In this introduction section, we will distinguish amidst what is forensic science and how it is different from cyber forensics. Forensic science depends on the potency of the research scientists to develop a case draw based on the outcome of a scientific review. For instance , a DNA report analysis of a murder case can be undertaken without the previous knowledge of the victims name or exact situation of the crime.2 (Chakraborty, R.1990) On the contrary, cyber forensics sciences main focus is driven on information discovered during the investigation. However the challenge lies in the search hu nt down of valid and admissible evidence in the media storage of a computer. The middling storage capacity of a PC is approximately 300-500 Gigabytes at that placefore it is poser to totally scan through every single file stored on a suspects computer system, let al unitary those computer networks. 3 Casey, E. (2004PROCESSES THAT ASSIST TO DEVELOP CASE HYPOTHESIS /ALTERNATE HYPOTHESIS Beforewe develop a case hypothesis or alternate hypothesis, at that place are some(prenominal) procedures and guidelines that a forensic investigator must(prenominal) heed and do. Firstly, the investigators must construct a hypothesis of the occurrence which is based on the study of the evidence. On the other hand, the degree of rigidity of this hypothesis as strong as relies upon the type of investigation. For instance, an Interpol police investigation would require the preparation of a enlarge hypothesis with discreet and meticulous proper documentation to support specimens place during th e examination.4 Ciardhuin, 2004In the case of a police investigation , the hypothesis will be presented before a jury however the hypothesis drawn in a company will be handled by the management. Technically the hypothesis will be verified and an alternate hypothesis as well as supporting evidence will be presented before a jury.The investigators will need to affirm the legitimacy of their hypothesis and protect it against any critics or provocation. In the event if the challenge is successful, there will be a need to backtrack to the earlier stages to collect and search for more evidences so as to construct a better hypothesis. Talking to the experts AKA luscious tubbing is widely used for coexisting evidence. This process involves the court to put several expert witnesses on the stand together which will in stoop saves much time and resources. Moreover, there are two main types of witnesses testimony at a trial, deposition or hearing. They are technical or scientific witness te stimony and expert witness testimony. 5Enfinger, 2006 As for technical or scientific witness, the investigator would need to present details of evidence that were discovered during the investigation. They would be asked to describe what was discovered and how it was acquired. During the compilation of the evidence, the investigator must ensure that the evidence collected must be legal and through with(p) appropriately with the permission of the owner and the suspect as well as a search warrant or hot pursuit.Also, it is essential that extenuating and inculpatory evidence is presented. 6 Cohen, 2006 On the other hand , the investigator would plan out the strings of events that have certain connections and linkage to form the chain of custody which is basically a documentation or paper lead displaying the seizure, control, transfer, analysis, custody and deposition of physical or digital. Apart from the chain of custody, there is another process known as the chain of Inference whi ch is also referred as concatenate inferences.These inferences amongst the weak and the strong ones build upon one another until they reduce the gap between the defendant and the conclusion to a manageable distance. The concatenate inferences process may be interpreted by fabricating a hypothetical scenario. The purpose of constructing a chain of inferences is to convince a fact finder that the desired conclusion is the most plausible rate of events. On top of this, it is also vital to internalise the difference between evidence and inference before the development of a hypothesis or the reconstruction of the crime scene.With that comes the formation of crime scene timelines which is an efficient order to derive a conclusion. It is a graphical chart that illustrates the activity time line of crime scene sorted based on the sequence of events. These log entries displayed a unique chain of events that culminate in the mishap which is a closer step towards proving a case. 8 Stephe nson, 2000 Another important process is testing, analysing and reporting. Testing is to ensure that all evidence both physical and electronic gathered must be verified and gone through musical note check by scientific personnel to affirm the originality without contamination as well as how this proof of evidence would be of any aid to solve the crime. Analysis deals with what are the issues identify and intention of the crime act and for for each one issue how it can be addressed, documented, tested and verified. Lastly this analysis will be written down and documented as a report. 9 Robert F. windlass and Donald T. Campbell, 1969