Computer Forensics: Computer Crime Scene Investigation (With CD-ROM) (Networking Series)

COMPUTER FORENSICS ASSISTANCE TO HUMAN RESOURCES/EMPLOYMENTPROCEEDINGS

Computer forensics analysis is becoming increasingly useful to businesses. Computers can contain evidence in many types of human resources proceedings, including sexual harassment suits, allegations of discrimination, wrongful termination claims, and others. Evidence can be found in electronic mail systems, on network servers, and on individual employee’s computers. However, due to the ease with which computer data can be manipulated, if the search and analysis is not performed by a trained computer forensics specialist, it could likely be thrown out of court.

Employer Safeguard Program

As computers become more prevalent in businesses, employers must safeguard critical business information. An unfortunate concern today is the possibility that data could be damaged, destroyed, or misappropriated by a discontented individual.

Before an individual is informed of their termination, a computer forensic specialist should come on-site and create an exact duplicate of the data on the individual’s computer. In this way, should the employee choose to do anything to that data before leaving, the employer is protected. Damaged or deleted data can be replaced, and evidence can be recovered to show what occurred. This method can also be used to bolster an employer’s case showing the removal of proprietary information, or to protect the employer from false charges made by the employee.

Whether you are looking for evidence in a criminal prosecution, in a civil suit, or determining exactly what an employee has been up to, you should be equipped to find and interpret the clues that have been left behind. This includes situations where files have been deleted, disks have been reformatted, or other steps have been taken to conceal or destroy the evidence. For example, did you know:

• What Web sites have been visited?

• What files have been downloaded?

• When files were last accessed?

• Of attempts to conceal or destroy evidence?

• Of attempts to fabricate evidence?

• That the electronic copy of a document can contain text that was removed from the final printed version?

• That some fax machines can contain exact duplicates of the last several hundred pages received?

• That faxes sent or received via computer may remain on the computer indefinitely?

• That e-mail is rapidly becoming the communications medium of choice for businesses?

• That people tend to write things in e-mail that they would never consider writing in a memorandum or letter?

• That e-mail has been used successfully in criminal cases as well as in civil litigation?

• That e-mail is often backed up on tapes that are generally kept for months or years?

• That many people keep their financial records, including investments, on computers?^[i]

^[i]“Computer Forensics,” Rehman Technology Services, Inc., 18950 U.S. Highway 441, Suite 201, Mount Dora, Florida 32757, 2001. (©Copyright 2002, Rehman Technology Services, Inc. All rights reserved), 2001.