Using cellular forensics for internet infidelity and divorce

In today’s world a cellular device has just about replaced the computer. Today, billions of mobile devices are in use worldwide. The growth for cell phones and the growing number of PC-like features being incorporated into their design are fueling the theory that the cellphone will soon become the new laptop.

In any internet infidelity or divorce case, it is very important to review the information contained on the guilty party’s mobile phone, as long as the consent to search is present. Often times when a computer is shared in the home, the cell phone becomes the mechanism of the affair.

Some of the data that can be recovered from a cellular device is:

- Call logs (date, time, phone number, duration of calls)

- SMSs

- WhatsApp messages

- Calendar entries

- Photos 

- Videos

- Emails

- Phone details

- SIM card data

Feel free to contact us at DLA digital and cellular forensics for any further information or assistance on cellular forensics!

What is Forensic Data Recovery?

Forensic data recovery is not magic; in fact it is actually very technical. People always wonder how the forensic experts can conjure up stuff from smartphones, tablets or hard drives that the owners thought were gone. So, how does forensics data recovery work?

Sometimes forensic data recovery is as simple as trying to reconstruct the information on a damaged hard drive, disc or memory card. At other times, it may include the resurrection of data that was thought to be lost or deleted, the bypassing of security systems or the study of a smartphone for traces of certain activity.

Because specialists in forensic data recovery may be working with computers which have been seeded with safety measures to prevent legal investigations, they must use special procedures to avoid compromising or erasing data.

Forensic data recovery is not magic at all. It is highly sophisticated and in order to be admissible in court, must be completed by professionals using complex tools and protocols.

DLA digital and cellular forensics can find the data that you need! DLA knows forensics inside and out, so if you need a professional when it comes to any forensic data recovery - Contact DLA now!  

Your video may prove guilt to you, but not in court

Because of the constant flood of easily accessible technology, security cameras seem to be more plentiful than ever before…

- Many private residences now install security cameras around the exterior of their property.

- Business owners install cameras in work areas and entrances.

- Parents with children often install surveillance equipment to keep tabs on the safety of their children with caregivers.

Those constantly rolling cameras can often hold people accountable for bad behaviour. In the event of videotaping a suspected criminal, people have a false security about their video skills. You might assume that you don’t need the services of professionals like DLA digital and cellular forensic investigators, after all, you can do it yourself, right? You will change your mind after you read what goes into providing video evidence for court…

- When you review a video to make sure you have clearly caught a crime on tape, don’t just immediately decide that dark footage is useless. Actually, dark footage is easier to enhance than overexposed footage.

- Immediately confiscate the equipment used for the video. If the event was recorded through the use of a camera phone, home camcorder or a security camera, immediately turn this equipment and video over to the proper authorities.

- Quickly make a decision about how you wish to allow the footage to be rewound and repeated. In a court trial, jurors may not be as shocked by a crime caught on video if they repeatedly view it.

- If at all possible, involve a video expert experience in evidence handling to be involved with the set-up and operation of the equipment. This person is not only easily accessible for computer glitches. But also, the presence of a legal video expert gives you credibility.

In order for video evidence to be admissible in court, it must comply with the proper recording and preservation guidelines. You might know you have evidence, but you might not be able to use it like you think.

If these important tips have made you question whether you are capable of producing the required evidence of wrongdoing or to prove innocence, it’s time to call the professionals at DLA! 

Mobile Phone Analysis

Mobile devices are becoming increasingly powerful and popular, with people even sometimes carrying more than one. However, their increasing capability provides more opportunity to store and circulate information.

Mobile devices have many different features, like the ability to take photos and videos. When a multimedia file is taken, many devices automatically embed GPS location of the handset at that time. This then allows the location of the user at that exact moment to be established at a later date.

Multiple communication features, such as Bluetooth, WiFi 3G and 4G enable the transfer of information that can even cross international boundaries. Users can browse the internet, send and receive emails, post blogs and even removable media cards can be inserted into the device allowing information to be exchanged.

Depending on the client, the following information can be recovered from a mobile phone:

- SMS
- Email
- Call history
- Photos
- Videos
- WhatsApp history
- Passwords

Mobile devices are similar to computers, but with far more powerful capabilities. The value of the evidence found on a smartphone or any other mobile device must never be overlooked! DLA has the cellular and digital expertise to extract and uncover the evidence you need.

The other side of mobile forensics

Mobile or cellular forensics isn’t just about finding WhatsApp messages, images and recent calls; it can also reveal much more. There’s a whole other side to it, which can include carrier data, call logs, undelivered messages and important data that reveals your exact location at the time of the incident. Matched together with the information saved to your mobile device, and mapped together with street names and landmarks, carrier data can enhance data on your device.

The best thing is, if cellular forensics is being used in an important crime case, they can be used to break the case. However, a lot of investigators overlook this critical evidence.

Most cell towers consist of poles that send and receive signals in three sectors; this makes it easier as it enables them to identify which side of the tower communicated with a cellular device.

Carriers keep detailed call records of these communications for billing purposes, so the data includes information like date, call length, whether a call was inbound, outbound, or went to voicemail.

Tower data reveals whether the device was in motion or stationary. A person dialing from one location will hit the same side of the same tower, but a person on the go will hit different towers and different sides.

In an investigation that uses mobile forensics, carrier data information can be vital. It can be used to place a phone in a certain area at a specific time, identify call patterns, establish timelines and identify suspects. 

DLA is based in Cape Town and combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to achieve the results that you require. Contact us today today!

What is a forensic audit, and why do they require digital forensic services?

Here at DLA, some of our top clients include forensic auditors, as they require our digital forensic services for their forensic audits. But what exactly is a forensic audit and what does it mean?

Read on to explore and find out what a forensic audit is, when they are used and how they are used in court…

A forensic audit may sound like something quite exciting that you’ve probably heard on crime dramas like CSI and Law and Order, but the truth is, it is a little more boring.

A forensic audit is the process of reviewing person’s or companies financial statements to determine if they are correct and lawful. Forensic accounting is most commonly associated with tax audits, but can also be commissioned by private companies for digital forensic investigations.

So, when are forensic audits used? Forensic audits are used wherever an entity’s finances present a legal concern. For example, it is used in cased of suspected embezzlement, fraud, to investigate a spouse during divorce proceedings and so much more. This is where digital forensics comes in; our services are specifically designed to help forensic auditors in these cases.

Forensic audits are performed by a class of professionals with skills in both criminology and accounting, so they specialize in following a money trail, keeping track of fraudulent and actual balance sheets and checking for mistakes in income reports and expenditures. If they find any discrepancies, it may be the forensic auditor’s job to investigate and determine the reason for it, with the help of a digital investigator if digital evidence is needed!

How are forensic audits used in court? They are presented as evidence by a prosecutor or by a lawyer representing an interested party. Because finance is so complicated, the way a forensic auditor will describe a company’s financial position is often very precise. Because of this a prosecutor or lawyer will call an expert witness to explain the forensic audit in simpler terms in order to build a case.

Forensic audits cover a wide range of activities, and they can be a part of many different investigations, digital forensic investigations being one of them.

Uncover the truth about your data with cellular forensics

A few years ago, the main source of truth came from email servers. These days, work communications have elvolved and are not limited to just laptops and PCs. They have burst onto the scene with WhatsApp messages, instant messaging and mobile sharing apps.

So, where is your data going? And where is it stored?

79% of business users use SMSs or WhatsApp messaging for business communications. Those text messages can pose a significant risk.

60% of those that allowed SMSs or WhatsApp messaging had minimal or no confidence in their ability to produce messages if requested.

Outside of audits, litigation and e-discovery requests are the #1 reason digital communications data is leveraged.

Standard questions legal has for IT during discovery of data:

- Where is the backed up data stored?
- What are our retention and archival policies?
- How is the company currently backing up the data stored on laptops, PCs and mobile devices?
- Which devices (Windows, iOS, Android, Linux) are in use?
- How do we manage data belonging to ex-employees?
- How does our existing software handle and implement data privacy and confidentiality policies?
- Can we collect and preserve delete messages?
- How can I monitor messaging communications on mobile devices for adherence to regulatory mandates or internal compliance policies?

With cellular forensics, IT can:

- Give legal information about the company’s data assets
- Educate legal on all the software IT uses to manage data
- Look for opportunities for IT to identify and collect data that can facilitate repeatable collections and reduce spoilage risk.

SMSs and instant messages are increasingly an issue in investigations. But by extracting them from cellular devices can be expensive and time consuming if you don’t know what you’re doing. Contact DLA Cellular and Digital Forensics and we can follow the digital trail on your cellular or digital device to get the evidence that you need.

The Different phases of a Computer Forensics Investigation

Here are the following steps investigators should follow to retrieve digital evidence…

1. Secure the computer system to ensure that the equipment and data are safe. This means digital investigators must make sure that no unauthorized individual can access the computers or storage devices involved in the search.

2. Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. Digital investigators should make a copy of all the files on the system. This includes files on the computer’s hard drive or in other storage devices.

3. Recover as much deleted information as possible using applications that can detect and retrieve deleted data.

4. Reveal the contents of all hidden files with programs designed to detect the presence of hidden data.

5. Decrypt and access protected files.

6. Analyze special areas of the computer's disks, including parts that are normally inaccessible.

7. Document every step of the procedure. It's important for digital investigators to provide proof that their investigations preserved all the information on the computer system without changing or damaging it.

All these steps are incredibly important in a computer or digital forensics investigations, make sure you follow them all to ensure an effective investigation.

DLA Digital and cellular forensics can provide you with the digital evidence that you need! Let us follow the electronic trail to find and protect the evidence that you need.

How digital investigators gather evidence and solve crime with social media

Social media can be a great tool to document our daily lives, and when it comes to solving crimes, law enforcement officials and digital investigators view it as a valuable tool, too.

Who & How

An survey showed that majority use social media for several reasons:

1. Identifying people
2. Gathering evidence
3. Discovering criminal activity and locations
4. Community outreach
5. Soliciting crime tips
6. Notifying the public
7. Recruitment

People put a great amount of personal, detailed information online. Targets even brag and post illicit valuable information in reference to travel, hobbies, places visited, functions, appointments, circle of friends, family members, relationships, actions, etc.

The networks most used by law enforcement officials and digital investigators:

- Facebook
- Twitter
- Youtube

Some social media platforms can reveal more information than others.

DLA combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to acquire the digital evidence that you desire.

Emergency Guide: The Do’s and Do Not’s of Computer Forensic Emergencies

Read this vital guide on saving evidence in Computer Forensic Emergencies…

DO – Make detailed noted on all activities
> Collect data that would otherwise be lost by removing the power supply.
> If the device is switched on, record what is on the screen by taking photos or by making a written note of the content.
> Ensure that actions or changes made to the system are recorded. > Ask the user about the setup of the system. E.g. Passwords, usernames etc.

DO NOT – Switch on the computer

> Every time a computer is switched on data can be changed
> Make sure that the computer is switched off
> Look for activity. E.g. lights may indicate power/activity. Remove the main power source battery from laptop computers

DO – Unplug the device to ensure information cannot be overwritten
> A computer in sleep mode may be accessed remotely, allowing the alternation or deletion of files.
> Remove the power supply from the back of the computer without closing down any programs. This avoids any data being written to the hard drive with power loss.
> Remove all other connection cables leading from the computer, and make notes.

DO NOT – Continue to use the computer device
> After an incident has been established, continued usage of the computer device could prove devastating to the existing evidence.
> Deleted data can still be present on the machine, but marked as ready to over-write. Use of the computer overwrites existing data on the hard drive which could hold important evidence.

DO – Secure or seal the system in a locked cupboard or container
> By securing the computer, this can restrict any unauthorized access to the computer, which minimizes potential data loss.
> This also provides a level of protection from natural hazards or accidents that may occur around the device and cause damage to the system.

DO NOT – Let your IT department or computer specialists “have a quick look”
> Without the use of special digital forensic software and tools, tampering with the evidence can cause data to be lost or corrupt.
> Commercial “Data Recovery” software does not work for evidential purposes and could result in data loss

DO – Call us right away
DLA has grown to become a great provider of digital forensic services in Cape Town and nationwide. We pride ourselves on offering the highest quality digital forensics and delivering thorough, detailed and accurate results.  Contact us today and we can provide you with the digital evidence that you need.

Recover computer evidence quickly and easily!

People use their computers for almost everything; many of these things can be used against you. Hiding money, illegal activities, inappropriate emails and just about anything you can think of.

Often, if you are trying to hide something, you’ll make an effort to completely clean out your computer by deleting “everything” and reformatting. The problem is, when you contact IT support and you are told that all is lost, they probably have no idea what a digital forensic investigator can do!

The harsh truth is that the evidence is still there, waiting to be found, you just can’t see it. The only question is, do you want it recovered or not.

Many businesses that have a disgruntled employee, or feel that an employee is involved in unacceptable activities at work, may want to acquire some digital evidence, they can use a digital forensic investigator to recover all the evidence that they need.

We at DLA are pleased to provide all the evidence that you need off of a computer, cellular device, laptop or tablet. The obvious advantage that we have here at DLA is that we recover digital evidence that few others could and keep all affairs private.

Need something recovered? Don’t hesitate to give DLA a call.

How do I save my WhatsApp chat history?

Saving your WhatsApp messages is a relatively easy thing to do, and although it is possible to recover your WhatsApp history if it is ever lost, it’s better to just save them from the beginning to avoid problems later. Here’s how:

Your WhatsApp messages are automatically backed up and saved on your phone’s memory on a daily basis. If WhatsApp is uninstalled and you don’t want to lose any of your messages, make sure to manually back up your chats before uninstalling.

1. Open WhatsApp and go to Options > Settings > Chat History > Backup chat history.

2. Press Yes to back up your chat history.

If you are deleting and reinstalling WhatsApp, you will be asked to import your backup after you first open your new copy of WhatsApp. Simply press Restore and your chat history should begin to load.

If you need to transfer your chats from on phone to another, transfer your SD card to your new phone before installing WhatsApp. If you do not have an SD card, you will need to copy the whole “wa” folder from your old phone onto your new phone’s memory. Install WhatsApp and click on Restore when you see it, and your chat history should begin to load.

Here’s some useful technical information you may want to know about your backup:

- Backup files are saved in the “wa” folder and are called MsgStore.bak.

- Backup files are saved to both your phone’s internal memory and SD card, but only given that there’s enough space.

- Backup files are only valid for 7 days after the last save. Make sure you import your chat history before it expires!

- Backup files are phone number sensitive; they’ll only work with the same phone number.

- Backup files are saved in a format to be opened with WhatsApp. If you want to read your conversations on your computer, you can send them as .txt files from WhatsApp to your email.

DLA is based in Cape Town and combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to achieve the results that you require. We do many services, from data and WhatsApp history recovery to image and CCTV enhancement.

How to become a Digital Forensic Expert

As technology advances, those in the criminal justice and criminology fields have to learn to change with it. More people conduct business online, and more occupations require at least some use of a computer or cellular phone.

To combat and investigate crimes involving computers and mobile phones, new career opportunities for digital forensic experts have sprung up.

What do digital forensic experts do? Well, as the name implies, they reconstruct and analyze digital information to aid in investigations and solve computer-related crimes. They can look into incidents of hacking, recover chat history and even recover lost or stolen data.

Some of the services of a digital forensic expert often include:

- Recovering data from damaged or erased hard drives

- Gathering and maintaining evidence

- Working with cellular devices, computers and other electronic equipment

-  Digital image enhancement

- Recovering SMS or chat history

Private companies and government organisations may employ digital forensic investigators full time, or they may contract for their services. Investigators will likely be involved in looking for violations of company policies regarding computer use as much as they will be involved in crime solving.

What are the education and skill requirements for a digital forensic investigator? Well, of course you will need a wide variety of knowledge regarding the investigative process, the law of evidence, computer operating systems, mobile devices and different types of hardware and software.

In addition to computer skills and related education and certifications, digital forensic investigators and digital forensic experts must also possess strong analytical and investigative skills. They need to be able to read and interpret data and to formulate conclusions, and they must be able to present their findings and conclusions in a format that can be easily understood.

A digital forensic expert’s job is both stimulating and rewarding. It allows you to put your unique skills and knowledge to work in a field that is truly helpful to others. 

Computer Forensics vs. Cellular Forensics

Although these two may seem very similar, computer forensics and cellular forensics are different in many ways.

Any type of criminal case may use computer and cellular forensics as evidence, including drug dealing cases, theft of intellectual property or trade secrets, murder cases and even less serious cases like a disgruntled employee.

While a computer is indeed a storage unit for data, cell phones differ by make and model and what type of data they contain, how it is stored, deleted data or how GPS is monitored.

When you contact a digital forensics investigator, make sure you are prepared with all the information…

- Make and model of the computer or cell phone

- The owner or account holder

- Whether or not the device is password protected

- Whether or not you know the password

It is also essential to explain exactly what information you would like to collect or what you suspect has happening and how the data will be used.

So, do you need a computer or cellular forensics investigator?

Unfortunately, as more people are affected by cybercrime and technology plays a bigger role in criminal and civil matters, you may need one of the following investigators:

- Computer forensics investigator

A computer forensics investigator will recover data from a computer. If you need evidence of activity on your computer, a qualified computer forensics investigator can get you all the proof you need. These investigators even have the ability to find hidden or deleted data and emails.

- Cellular forensics investigator
Depending on the make and model of a cell phone, a cellular forensics investigator will recover data, passwords, chat history, SMSs, photographs, GPS and other information from a cell phone. They even have the ability to access deleted or hidden information from a device.

Would you like the help of experienced investigators? Contact DLA today and they will use the latest technologies to achieve the digital evidence that you need!

How digital forensic investigators use social networking for evidence

Social media is much more than it may seem. It’s not just “likes” and posting photos and sharing statuses. Important evidence and even corporate business records have become integrated into social media sites such as Twitter, Facebook and LinkedIn.

Most of the time, the content investigators are looking for on these social media sites are in relation to:

- Conducting a background check or making an accusation against a witness

- Determining a corporate position on an issue, fact or circumstance

- Proving whether a person was cyber-bullied or threatened

- Establishing whether someone associated with another person of interest

- Evidencing intent, weakness or motive

- Challenging an individual’s physical location alibi

However, over the years people have argued about whether using social networking site content violates their rights, whether the site itself infringes the privacy of its users or even whether illegal activity occurs with actual knowledge of it happening.

In light of this, make sure the evidence is preserved and acquired properly is critical, which can be hard given its dynamic and multi-format nature. To properly collect and authenticate social networking content, the correct tools and programs need to be used at all times. Significant digital forensics skills are needed to analyze the preserved data to answer questions like:

- Who posted the offending content?

- Can the offending content even be attributed by convincing evidence to a real, live person?

- When was the offending content posted on the social media site?

- How much of it exists across the entire social networking platform?

- What other related evidence is there?

- How accurate is the reported physical location

We use social networking constantly; it is basically a part of our everyday lives. So, because people choose to broadcast their personal lives to the public, digital forensic investigators can use it to get current and accurate evidence.

DLA can provide you with a wide variety of services, from data and WhatsApp history recovery to digital suspect profiling and image verification.

The challenges of digital forensics

Forensics is changing, because as the years go by we are living more and more in a digital age. However, the legal system is still catching up when it comes to properly using digital evidence.

So, what is digital evidence? Digital evidence is information found on a wide range of electronic devices that is useful for court cases or situations with disgruntled employees. It is basically like the digital equivalent of a fingerprint or a strand of hair left at the scene.

However, digital evidence that is used in court often fails to meet the same high standards expected of more established forensics practices, especially in making sure the evidence is exactly what it is portrayed to be.

It has become common for criminal trials to rely on digital evidence. And it is not uncommon for innocents to be convicted and guilty people acquitted because of digital evidence.

There are many different reasons for this.

First, the evidence might be compelling when you first look at it, but it could by misleading. Other investigations might not even get to trial because of the complexity or incompleteness of the evidence.

It is a bit worrying that some defendants are pleading guilty based on what appears to be great digital evidence, but in these cases the defense lawyer may not understand it. This is why digital forensics consultants are so important.

Forensic analyses and presentations of digital evidence are sometimes explained by investigators that have little or no experience, which is then made worse by faulty case management.

Another problem may be that the digital forensic processes and tools are not seen as reliable.

Now that we are living in the age of technology, digital forensics will forever have an impact on the way that evidence is gathered and presented in court.

Browse DLA and learn a little more about the world of cellular forensics, data recovery and digital forensics. 

Cellular Forensics

Cellular forensics has really changed things when it comes to suspect profiling. The fact that people use mobile devices so frequently these days has provided investigators with another source for profiling criminal suspects, as well as helpful insight into their personal habits and personalities.

This is not just from all the calls and SMSs that are sent and received, but also from the rich data that can be extracted from messaging apps (WhatsApp, BBM) and social media apps (Facebook, Twitter) gives digital forensic investigators the ability to develop a picture of a suspect and a criminal case.

A suspects’ social media personality can offer a more tailored overview of the character, his or her likes and dislikes and a reflection of “who” they really are. A victim’s presence on social media can also be used to find a common link to possible suspects!

The widespread use of cellular apps makes them a source of extremely critical data for digital investigators and general law enforcement officers, both in terms of evidence and investigative leads.

These days’ people use their mobile devices to access social media apps rather than using their laptop or computer. Even more so, social media data can actually be extracted from a suspect’s mobile device and provide details such as, their WhatsApp chat history, location-based data, recovery of images and frequently contacted people.

Investigators can even find out when someone was in a certain place at a certain time by looking at the WiFi all the networks they have ever connected to.

While data points such as SMSs and GPS locations can end up in a great lead in a criminal case, looking at the online social identity of a suspect will allow investigators to dig deeper into the personality of the suspect, which can help to build a case.

Suspect profiling is changing as people use more and more social apps to communicate with one another. This is providing digital investigators with another source of information to build up a complete profile of a suspected criminal.

The amount of data that is now being consumed and shared is opening up a huge amount of different opportunities for cellular forensic and digital suspect profiling cases.

At DLA digital and cellular forensics, we never lose sight of the goal of an investigation, which is to identify the suspects and find the perpetrator using digital suspect profiling.

What Is Data Recovery And How Does It Work?

We’ve all dealt with data loss, whether it was from a hard drive failure, data corruption or accidentally deleting a file. If you’ve ever experienced a major loss of data, you’ve probably wondered about data recovery — how does it work? How effective is it? How much does it cost?

Data Loss and Data Recovery

Data loss can take many forms — accidental deletion, hard drive failure, software bugs, data corruption, hacking, even a simple power failure can cause you to lose data. And, of course, there are more extreme cases, like when a hard drive is recovered from a plane crash; amazingly, some data recovery specialists can retrieve data from storage media that’s been almost completely destroyed.

If a piece of data used to be on your hard drive, USB stick or other storage media, you might be able to hire someone (or purchase some software) to perform data recovery. Data recovery is, simply, the salvaging and repair of data that has been lost.

DLA can recover your data quickly and easily, by combing the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to achieve the results that you require.

Of course, data recovery won’t always be possible; sometimes a system can be too corrupted or damaged to get much of the data back. However, data-recovery technology has become extremely advanced.

How Does Data Recovery Work?

The methods used to recover lost data depend on how the data was lost in the first place; let’s take a look at some of the most common forms here.

- File Deletion

- File Corruption

- File System Format or Damage

- Physical Drive Damage

- Solid State Drive Data Recovery

DLA can do a great job of getting your data back, but the best measure you can take to prevent long-term data loss is the one we’ve been advocating for a long time: make lots of backups! 

How police are using digital forensics to solve crimes

Forensic investigations seek to uncover evidence and then analyze it in order to get a proper understanding of the crime. As computers and digital devices have become a part of our daily lives, the cyber realm contains all sorts of potential evidence for all types of criminal investigations.

Technology is volatile and we’ve seen technology advancements in the last five years, probably like no other period in time.

So, how are police using digital forensics and what crimes have they solved?

BTK KILLER

BTK was a serial killer in Wichita, Kansas who named himself after his method – Bind, Torture, Kill.

He killed at least 10 people over a period of 30 years. After he killed, he would then taunt police with letters detailing his crimes.

The Evidence

- By posting ads through the local newspaper, BTK asked police if he could communicate with them via floppy disk without being traced back to a particular computer.

- The police lied and said yes. The floppy disk was quickly traced to a computer at the church where Dennis Rader was president of the congregation.

- DNA tests matched radar to the BTK murders.

The Outcome

- Sentenced to 175 years in prison

SCOTT PETERSON

Laci Peterson, who was 8 months pregnant, was reported missing by her husband, Scott Peterson. That same morning, Peterson claimed to be on a solo fishing trip near Brooks Island.

The bodies of Laci and her unborn son washed up on a beach a few months later. The patterns of water currents make it possible that Laci’s body was dumped near Peterson’s fishing spot.

The Evidence

- Peterson searched ads for used boats, fishing information, and boat ramps in the area.

- On the morning of Laci’s disappearance, Peterson made a call from his home to his voicemail after he claimed to have already left for his fishing trip.

- Wiretaps suggest that after Laci’s disappearance, Peterson lied about his whereabouts to friends and family.

The Outcome

- On death row

THE CRAIGSLIST KILLER

“Craigslist Killer” was the nickname given to the man who bound and robbed three women, killing one.

The Evidence

- Police used video surveillance to find images of the killer.

- Traced the phones he used to call the victims to disposable phones.

- Traced the email used to respond to the Craigslist ads to the IP address of Philip Markoff.

- Police followed Markoff, gathered fingerprints, which matched those on the crime scene.

The Outcome

- Committed suicide while awaiting trial

CASEY ANTHONY

Cindy Anthony, Casey’s mother called the police to report that her two year old granddaughter, Caylee, was missing.

Digital forensic experts found several suspicious searches on the Anthony home computer.

The Evidence

- Casey told police that her daughter had been abducted by her nanny a month before. Casey was arrested for child neglect.

- FBI lab results show that chloroform was found in Casey’s car.

- Caylee Anthony’s remains were found ¼ of a mile from the Anthony home.

The Outcome

- Sentenced to 4 years in prison

Digital forensics and forensic investigations seek to uncover, analyze and preserve evidence to be used in criminal proceedings.

DLA is based in Cape Town and combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to achieve the digital forensic results that you require.

Digital Forensics in Criminal Investigations

Computers and other digital devices are commonly used to commit crimes these days, and thanks to the science of digital forensics and digital evidence, law enforcement can now use computers to fight crime.

For digital evidence to be legally admissible in court, investigators must follow proper legal procedures when recovering and analyzing data from computer systems.

Sometimes the law cannot keep up with technological advancements and this may ultimately limit the use of computer forensics evidence in court. Privacy advocates are growing especially concerned that computer searches may be a breach of a suspect’s human rights. So, as methods to hide evidence become more advanced, technology may be abused by helping criminals hide their actions. In the end, the role of technology in digital forensics may not reach its full potential due to legal boundaries and bad intentions.

Computer and computer-based forensics has been an important part in the conviction of many well-known criminals, including terrorists, sexual predators, and murderers. Terrorist organizations may use the Internet to recruit members, and sexual predators may use social networking sites to stalk their potential victims.

However, most criminals fail to cover their tracks when using technology to implement their crimes. They fail to realize that computer files and data remain on their hard drive even when they are deleted; this allows investigators to track their criminal activity. Even if criminals delete their incriminating files, the data remains in a binary format due to “data remanence” or the residual representation of data. File deletion simply renames the file and hides it from the user; the original file can still be recovered.

Eventually, data may be overwritten and lost due to the strained nature of computer memory, a storage area for used data. A random access memory chip (RAM) retrieves data from memory to help programs to run more efficiently. However, each time a computer is switched on, the RAM loses some of its stored data. Therefore, RAM is referred to as volatile memory, while data preserved in a hard drive is known as persistent memory.

The RAM is constantly swapping seldom used data to the hard drive to open up space in memory for newer data. Over time, though, the contents in the swap file may also be overwritten. Thus, investigators may lose more evidence the longer they wait since computer data does not persist indefinitely. 

Fortunately, computer scientists have engineered equipment that can copy the computer’s contents without turning on the machine. The contents can then be safely used by lawyers and detectives for analysis.

DLA is based in Cape Town and combines the experience of two seasoned investigators with both criminal and civil background with the latest technologies to achieve the digital forensic results that you require.

The History of Digital Forensics

Before the 1980s, crimes involving computers and digital devices were dealt with using existing laws. So, the field of digital forensics is relatively new. While its history may be short, it is quite complex.

As the years went by, the range of digital crimes being committed increased, but it was not until the 1980s that federal laws began to include computer offences. Canada was actually the first country to pass legislation in 1983, followed by the US Federal Computer Fraud and Abuse Act in 1986.

The fact that computer and digital crimes grew so much during the 1980s and the 1990s caused law enforcement agencies to start making specilised groups to deal with the technical aspects of the investigation. For example, the Computer Analysis and Response Team that the FBI formed in 1984.

Throughout the 1990s there was a high demand for these new investigative resources, this lead to the creation of regional and even local level groups to help handle the load. But, it was not until 1992 that the term “computer forensics” was actually used in academic literature.

Since the year 2000, a lot of people and agencies have written and published guidelines for digital forensics. A European lead international treaty, the Convention on Cyber crime, came into force in 2004 with the aim of reconciling national computer crime laws, investigative techniques and international co-operation.

The issue of training also received some attention. Companies, such as forensic software developers, began to offer certification programs, and digital forensic analysis was included as a topic at the UK specialist investigator training facility.

Since the late 1990s digital devices have become available everywhere, basically everyone has a phone or some kind of digital device. Devices have advanced way beyond simply communicating, they are great forms of information, even for crime not usually associated with digital forensics. However, digital analysis of phones has lagged behind traditional computer media, mostly because of problems over the ownership of the devices.

The complex field of digital forensics will always have unresolved issues. Many issues will include; increasing size of digital media, the wide availability of encryption to basically everyone, the variety of operating systems, increasing number of people owning multiple devices and lets not forget the legal limitations on investigators. 

DLA is based in Cape Town and combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to achieve the results that you require.