Question

In: Computer Science

Question about CyberForensic You are an expert witness in a court case. Explain to the jury...

Question about CyberForensic

  1. You are an expert witness in a court case. Explain to the jury what you did to recover the deleted images and documents. Be sure to provide a detailed description of each step taken (start to finish).

Solutions

Expert Solution

The steps used to recover the deleted images and documents are:

Step 1) Detecting deleted data

First of all checking the recycle bin. Many computer users, including criminals, believe that once they delete a file, it disappears from the hard disc. Even some experts believe that files are destroyed when recycle bin is emptied but this is not the case. The file still remains in the memory but we can't access it directly. So, if file not found in recycle bin the we followed the next steps.

Step 2) Finding hidden data

Extracting Data hidden in a disc zone . Some data remain present even after data deletion or disc repartitioning. Besides, there are many options for criminals with technical know-how how to hide data, mainly using a disc editor, stenography, encryption etc. Therefore we find recovery and reconstruction of hidden data

Step 3) Shadow Data

Another option that is examined is shadow data, created due to a difference in vertical and horizontal alignment of the magnetic heads. Namely, when accessing particular disc sector, the access points of head 1 and head 2 are not exactly the same, and this difference enables some data to remain present even after overwriting. Hence, it is sometimes possible (although very time consuming and expensive) to recover overwritten data.

Step 4) Steganography

Looking for hidden files within other files(Steganography). This type of encryption is made possible through empty space or change in value of the least significant bit. Eg: data hidden within images , lets say there is an image which is recorded through description of any single pixel represented by particular byte e.g. 10011000. When the least significant bit (the last one) is changed from 0 to 1, a different shade of pixel color is obtained and a hidden bit is created. In this way the entire file may be hidden within different parts of the image. Hidden bits and their order are detected by using several anti-steganography programs that can detect the presence of hidden files. Detecting the presence of hidden files is much easier than their reconstructing


Related Solutions

You have been hired as an expert witness in a court case involving an automobile accident....
You have been hired as an expert witness in a court case involving an automobile accident. The accident involved car A of mass 1430 kg which crashed into stationary car B of mass 1160 kg .The driver of car A applied his brakes 15 m before he skidded and crashed into car B. After the collision, car A slid 18 m while car B slid 30 m.The coefficient of kinetic friction between the locked wheels and the road was measured...
You have been hired as an expert witness in a court case involving an automobile accident....
You have been hired as an expert witness in a court case involving an automobile accident. The accident involved a car of mass 1870 kg (car A) which approached a stationary car of mass 1020 kg (car B). The driver of car A applied his brakes 10 m before he crashed into car B. After the collision, car A slid 17 m while car B slid 30 m. The coefficient of kinetic friction between the locked wheels and the road...
Assume the role of an expert witness who has been asked by a court of law...
Assume the role of an expert witness who has been asked by a court of law to assess whether and to what extent Koss management and Grant Thornton were responsible for failing to prevent or detect the embezzlement and accounting fraud.Write a two-page professional opinion summarizing what you believe went wrong, and whether and how Koss management and Grant Thornton failed in their responsibilities. Cite specific examples to support your conclusion. Conclude your report with an assessment of whether Koss...
What is an Expert Witness? What is the purpose of an Expert Witness? Who can be...
What is an Expert Witness? What is the purpose of an Expert Witness? Who can be an Expert Witness? What qualifies a person to be an expert witness?
You have been hired as an expert witness in a case involving an automobile accident. The...
You have been hired as an expert witness in a case involving an automobile accident. The accident involved car A of mass 1500 kg, which crashed into stationary car B of mass 1100 kg. The driver of car A applied his brakes 15 m before he skidded into car B. After the collision, car A slid 18 m while car B slid 30 m before coming to rest. The coefficient of kinetic friction between the locked wheels and the road...
You have been hired as an expert witness in a federal antitrust case. You are planning...
You have been hired as an expert witness in a federal antitrust case. You are planning your strategy for determining whether or not your client (the defendant in the case) has engaged in predatory pricing. How will you get started? In general what is your strategy? What must you do to successfully defend your client?
(a) An expert system developer lost a court case about a newly deployed system. The general...
(a) An expert system developer lost a court case about a newly deployed system. The general issue was based on the fact that the new system could not be differentiated from the old systems even though the new system functioned normally. In ten points, explain the specific issues about the system that the developer likely failed to present at the compiling stage. (b) The following code lines represent a simple expert system about a cancer image detection under computer vision....
Describe the various roles of the courthouse actors (defense, prosecution, judge, bailiff, court reporter, jury, expert...
Describe the various roles of the courthouse actors (defense, prosecution, judge, bailiff, court reporter, jury, expert witnesses, lay witnesses etc) or people you find on a typical day in a courthouse.
Discuss the role of an expert witness/fraud examiner in each proceeding of litigating and embezzlement case...
Discuss the role of an expert witness/fraud examiner in each proceeding of litigating and embezzlement case in civil court and criminal court
You have been hired as an expert witness by an attorney for a trial involving a...
You have been hired as an expert witness by an attorney for a trial involving a traffic accident. The attorney's client, the plaintiff in this case, was traveling eastbound toward an intersection at 13.2 m/s as measured just before the accident by a roadside speed meter, and as seen by a trustworthy witness. As the plaintiff entered the intersection, his car was struck by a northbound driver, the defendant in this case, driving a car with identical mass to the...
ADVERTISEMENT
ADVERTISEMENT
ADVERTISEMENT