Ethics in Digital Forensics

The process of computer forensics is quite complex and involves various activities such collecting, analyzing, preserving and presenting digital evidence collected from a computer in a legally acceptable manner. Proper care must be taken that the evidence is not altered or tampered with in any way. The role of the investigator is therefore crucial and any mistake on their part may put the whole investigation in jeopardy. To counter this problem, forensic investigators must follow some basic guidelines and rules suggested by different organizations. Please explain what codes should these professionals follow and which ones are the most relevant to you?

Ethics in Digital Forensics

As Barbara (2013) notes forensic investigators always have to worry on the best practices that should be applied to institute ethics and handling of digital data. The most relevant aspects that should be followed by forensic investigators should be the data collection procedure. Today, analysts do not just unplug the electronic equipment from the socket, it is imperative for them to understand how the crime scene looks. It is also very imperative to follow directives such as the legal consideration that confirm they have the mandate to do so.

Johnson (2013) recommends that the most essential component of the code of ethics is to focus on some of the activities that they should do in collecting data. For example, for standalone computers and their peripherals the procedure is to;

1. Photograph the scene and the computer
2. observing not to turn the computer on if it was off and photographing if it was on
3. Collection of live data which should begin with the RAM image. There are other activities such as the state of  network connection, individuals who were logged on and the various execution tasks that were on
4. In case they detect hard disk encryption  tool such as Zero-View should be used either locally or remotely
5. Unplugging power cords for desktop towers, while for laptops battery should be removed
6. The investigators should make diagrams while ensuring to label all cords
7. Documentation of the device at the scene being keen to note model and serial numbers of these devises
8. Any other cord or device should all also be disconnected
9. By use a write blocker or any recommended hardware imager investigators should check for HPA and image the hard drives
10. Packing should involve use of recommended bags which are antistatic
11. All other storage devices should also be packed as evidence
12. Investigators should be keen to avoid contact of radio or magnetic transmitters or elements that may be damaging
13. Documentation of notes and collection of instruction manuals should be done
14. While the process followed should be noted

The code that these investigators follow allows them to attain the most information of the crime scene and to make use of any data they may find in these scenes.