Wherever we go, we leave a physical trace behind, and science can be used to find and identify those traces. The individual nature of these traces can form a trail back to an individual.
This characteristic has been used for a surprising length of time which on investigation reveals examples such as the Chinese using fingerprints in the 700s and the re-construction of a newspaper fragment in a murder case in 1784. It is also claimed that the Emperor of China on about 3000BC used his fingerprint as a personal mark on documents, although it’s not obvious how effective it might have been without a fingerprint scanner!
These are examples of the trail that people leave in everything they do. Science is used to support the discipline of gathering and presenting evidence to courts, and the term forensics has become understood to mean forensic science. It has been more recently popularised by forensic medicine and the use of autopsies post mortem. More generally forensics embraces both science and technology in the gathering of the facts and evidence that are used to support cases presented in criminal or civil courts of law.
There are many domains in forensics, covering every aspect of the body, and a person’s interaction with their surroundings. The University of Central Lancashire illustrate this with their case studies which show the trail person leaves at the scene of a crime. We leave footprints, fingerprints and a trail of physical artifacts behind us, each capable of being tracked by a specialist forensic domain.
Since we use computers in our everyday life it is not surprising that our interactions with the virtual world also leave a trail. A magnetic medium may seem to have been cleared of files, but the traces of the files remain on the disc platter. Even if the files are cleaned of data, there is a residual trace on the edge of each sector, which is a legacy of the variation in the way that the physical magnetic disk heads move. However this new domain differs in one important respect, in that we are leaving a digital trace of our movement through the virtual world, whereas we have seen that forensics as a whole is concerned with detecting our trail through the physical world.
Apart from one discipline, all of forensics are concerned with the physical sciences, which look for concrete evidence of our personal traces. Computer forensics is unique in that it is concerned with the acquisition, authentication and analysis of digital data from cyber-space.
An expert in the field of computer forensics is equipped with knowledge of the way information traverses between our work stations. This movement of data involves its replication across networks and different forms of media. It is often held in computer memory will make a number of temporary and semi-permanent impressions of itself during its life.
As computers have grown to invade every part of our daily life, so t he opportunity for misuse have also grown. Information can be gathered across the world without moving from your desk. Computer forensic technicians follow a painstaking trail, often form computer to computer and across borders to track down the perpetrators of crimes and espionage. Given the right amount of effort and cooperation, the source of a data trail can be found.
Consider the billions upon billions of pieces of data that are transmitted around the globe every single day. This level of activity, makes it impractical to physically monitor and filter every digital conversation, and without a starting point there is no trail to follow.
Without a trigger, most data becomes sunk without trace.