Computer Forensic Incident Essay

Legal Statutes and Considerations

First of all, it is worth noting that the legal right for self-defense does not cover cyberspace. This means that a victim of a hacker attack is not allowed to “hack back,” in other words, attack the perpetrator (1). This determines the need for special legal statutes provide governmental regulation in the given sphere. Currently, all 50 states have the laws of such a kind that “encompass a variety of actions that destroy or interfere with normal operation of a computer system” (2). As much as anything else, cybercrime-related laws regularize evidence collection, which should involve the participation of electronic experts and not allow for any privacy right violation (3). Therefore, approaching the crime scene has to be based upon the existing legal considerations.

Steps and Procedures

When collecting digital evidence, it is critical to maintain data originality. This means that a forensic analysis should be a so-called clone, which stands for a copy of the original data collected from the device under analysis (3). After the submission of the evidence to the court, it has to be possible to explain any change from its initial state; ideally, there should not be any. Considering the latter fact, neither transfer process nor the analysis itself presupposes changing the data. Another essential point is the supervision of experts, under which only both evidence collection and investigation can happen. To avoid bias, not only the plaintiff should appoint experts, but other parties as well (3). Finally, in case any electronic data have been destroyed or deleted, it is essential to restore them accurately and without delay.

Crime Scene Analysis

The given diagram represents the workplace of the one who is suspected in hacking. It bears several electronic devices that are to be seized for evidence, notably, a PC, a smartphone, an external media drive, a router, and a wireless access point. All of those may bear traces of the cybercrimes that have been committed by their owner from this location, which has been confirmed by the IP address.

The gadgets to use for accessing the Internet, in particular, the router, as well as the wireless access point, are important for checking whether the detail of the crime involves their MAC-addresses. It is necessary as well to review both the PC and the smartphone for malicious software that enables an access to logins and passwords of users, hence the data protected by them. Finally, data themselves are doubtlessly incontrovertible evidence, which determines the need for examining all present memory devices. In the given case, those are the PC, the smartphone, and the external media drive. In addition, it is essential to check whether the suspect is using cloud storages, which determines the need for examining all devices that allow for surfing the Internet, such as the PC and the smartphone.

To summarize, all 50 states today have legal statutes to enable governmental regulation in the sphere of cyber safety. Investigation on cybercrimes involves collecting electronic evidence, that is, data stored on or accessible from the devices that belong to a suspect along with software installed on them. All evidence should be collected in the presence of experts in order to avoid losing data as well as violating privacy rights.

Sources

1. N. Winstead. 2020. Hack-Back: Toward a Legal Framework for Cyber Self-Defense. Web.
2. National Conference of State Legislators (NCSL). 2020. Computer Crime Statutes. Web.
3. Ya. Wu et al. 2019. Research on Investigation and Evidence Collection of Cybercrime Cases. Journal of Physics: Conference Series, vol. 1176, no. 4. Web.