Common Questions and Tasks

In some cases, a forensic examinationExamination is just about finding a picture, text, or e-mail. However, it is very common that the forensic expert is tasked with answering more complex questions such as determining who the user of a computer is or if a computer was remoteRemote controlled. While providing a definite answer to such a question is often almost impossible, this chapter introduces three methods that can be used to tackle those requests. First, analysis of applications is an attempt to complete a deep examinationExamination of applications related to a specific task, for instance, remoteRemote controlling computers. The idea is that analyzingAnalyzing the computer for any trace of such software could provide an indication of whether it existed or not. The next method is scenario testingScenario testing where the forensic expert tries to find evidence that is in favor of, or disproves, a stated scenario. The final method, useful for tying a person to some action, is timeliningTimelining where the forensic expert tries to cross-reference criminal actions with actions that can identify the computer user.