Talk:Computer forensics

message: Computer forensics is an emerging discipline, but there are colleges that offer computer forensics alone as a major.  Therefore, as a unique field of study, I believe that it is worth a whole wikipedia article
68.20.26.58 04:14, 28 August 2007 (UTC)
thread_title:  Probably shouldn't be merged 

message: Would anyone care if chassis is changed to case or maybe terminal? I can't say I've ever heard a computer case called a chassis.
worldtravller
I wouldn't call it a terminal - too ambiguous. If chassis is not acceptable, then case would be ok imo, but what's wrong with chassis - it's perfectly clear.
Try BaseUnit or data store 82.33.11.157 20:53, 11 June 2006 (UTC)
thread_title:  Chassis to Case 

message: This entry reads more like a how-to guide for the aspiring forensic analyst then an explanatory article about the subject. There's no background, history, examples of where such issues have arisen and been applied, etc.
:That was exactly my thought- this is not an encylopedia article.  It is also very PC centric, with no mention of Mac, Linux, servers or printers.  The forensics sections of Laser printer and Computer printer should be moved here, expanded and compared to the section in Typewriter.  Scanners should also be mentioned.  --Gadget850 19:22, 19 October 2005 (UTC)
replies: text: Agreed. This needs editing by someone who knows the subject in a way that keeps the content, which is great, but adjusts the tone to make it more encyclopedic. Are the original editors still hanging around the article I wonder? Coyote-37 14:31, 21 October 2005 (UTC)

text: I concurr --Gadget850 11:19, 5 November 2005 (UTC)

text: It definately needs work on stuffy wording and removing on gratuitous vendor references. EG. the vendor mention next to the first occurence of crypto filesystems is completely gratuitous. I would favour extracting a vendor-free overview with 'function' items and moving platform specific addressing of the items to their own sections. Also, it can probably be edited down to half the volume for the same content. 85.178.102.243 00:26, 19 September 2007 (UTC)
thread_title:  Informative article or guide? 

message: How about information about how to make it as difficult as possible for someone to recover such information.
    
    I would recommend creating a seperate article under the title Anti-Forensics, and providing a link.
It would be more applicable for the article to be forensic formatting or data recovery prevention as these are a more
technical description. Anti-Forensics sounds a bit made up.  —Preceding unsigned comment added by 172.189.101.180 (talk) 17:26, 14 November 2007 (UTC)
thread_title:  Prevention 

message: Many seem to confuse WP with a web directory. I checked the external links section, and here's my opinion. These are commercial link and pretty useless in this context (some disguise that fact better than others).
* www.sectorforensics.co.uk Computer Forensics Investigators
* www.forensicexams.org is a portal for computer forensic examiners to share information and ideas. 
* www.infosecinstitute.com/courses/computer_forensics_training.html InfoSec Institute Computer Forensics Training Hands on training and certification
* df.intelysis.com Intelysis Corp. Canada's Leading Digital Forensics Firm
* www.tkmtechnologies.com TKM Technologies Computer forensics company with news and articles
* www.data-recovery-reviews.com/computer-forensics-training.htm Computer forensics training What is computer forensics?
* www.ibasuk.com Ibas UK Computer Forensics Computer forensics company
* www.securestandard.com/Incident_Handling/Forensics SecureStandard Directory of forensics whitepapers.
* www.ecodatarecovery.com/forensic.html Forensic Investigation: Who needs forensics?
* www.forensical.com Computer Forensics Investigations
* www.securityuniversity.net/classes_anti-hacking_forensics.php Anti-Hacking  for Computer Forensics
* www.krollontrack.com/ Kroll Ontrack (Computer Forensics company)
* www.t3i.com/services/Information-Forensics/infoforensics.asp T3i (Computer Forensics company)
* www.silverseal.net/computerForensics.htm SilverSEAL Corporation Computer Forensics Investigations
Here's a bunch that could be useful if the sites were not way too small:
* www.forensicfocus.com Forensic Focus Computer forensics news, information and community
* www.computerforensicsworld.com Computer Forensics World Community of computer forensic professionals
* computer-forensics.safemode.org Computer Forensics Wiki
These could be sort of useful, but neither looks like a must-have:
* www.bleepingcomputer.com/forums/tutorial24.html Windows Forensics: Have I been Hacked?
* www.forensics.nl Forensics.nl Forensics Research, Tools and Presentations
So I basically nuked the complete external links section and renamed "Other Sources of Reading" to "External links". Algae 17:18, 20 December 2005 (UTC)
thread_title: External links

message: Moved to discussion. There are COUNTLESS software products for CF. Every vendor that pops along is now adding their product in here. It is getting way out of hand, and wiki is NOT a directory of software. 
I have therefore shifted the current ruck of product to this page. If we left it, it would get longer and longer and longer, and eventually consume the article, becoming a random directory of questionable commercial tools. 
* Encase EnCase Forensic by Guidance Software.
* ILook ILook Investigator by Department of the Treasury.
* The Sleuth Kit Open source disk and file system analysis software.
* Open Source Forensics Reference site with lists of open source analysis tools.
* Forensic Toolkit Forensic Toolkit by Access Data.
* EMail Detective Forensic Software by Hot Pepper Technology.
* Helix Live Linux CD Incident Response & Forensics tools including Autopsy and The Sleuth Kit by E-Fense
* Windows Forensic Toolchest (WFT) Live Incident Response & Forensics tool for Windows by Fool Moon Software
* Webtracer Webtracer, forensic analysis of internet resources, by 4IT.
* X-Ways Forensics commercial software
* BitFlare Computer Forensic tool for the non-expert, with free search, filtering, and preservation features.  —Preceding unsigned comment added by 71.246.222.115 (talk) 20:28, 22 January 2010 (UTC)
thread_title: Software

message: The table recommending different shutdown procedures seems to be made up, there's no references or any of the like. Naturally there are reasons for and against pulling the plug vs. shutting down, but none of them are introduced. However, listening to all the best practices I have heard (ie. forensics experts live or in web discussions, police instructions) there really is no reason to not pull the plug with any modern file system. This seems like a hobby project of someone. Nice at that, but not too expertly informed and definetly not encyclopedic. --Tmh 16:45, 10 January 2007 (UTC)
thread_title:  Shutdown directions 

message: Is anyone who actually work with computer forensics involved in this article? I reads a lot like someone just guessing. Also a complete lack of references. --Apoc2400 04:58, 19 March 2007 (UTC)
replies: text: After over a year since I did some clean up, I'm going to try and clean this up even more. I removed all of the e-mail sections just now, as they do not fit into the overall focus of computer forensics. There are many areas like email that are, or were, explained in too much depth and should be trimmed heavily back. --edit-- just realized I misspelled the edit a bit, s/now/not Rurik (talk) 15:53, 29 March 2008 (UTC)
replies: text: I know a little, (from an amateur interest in file systems and hardware), enough to sift out some chaff today.  Still needs work though, much redundancy remains.  On focus: the topic is fairly general, (I see it as related to reverse engineering and honorable hacking, of interest and use to most computer experts), but the current article seems biased in favor of its admittedly important law enforcement applications, as though it were an advocacy tract for an emerging professional subclass.  It's better we describe what's out there, not professional ideals, hopes, or what "should be".  --AC (talk) 06:53, 1 May 2008 (UTC)
replies: text: I have a PhD in this area. We also run a wiki devoted to this subject (http://www.forensicswiki.org/). My feeling is that this entry should be edited down and much of the content moved there. Simsong (talk) 04:37, 6 July 2008 (UTC)

text: PLEASE DELETE: "To recover data in the event of a hardware or software failure.
To gather evidence against an employee that an organization wishes to terminate.
To gain information about how computer systems work for the purpose of debugging, performance optimization, or reverse-engineering."
Computer Forensics seeks to explain the state of a digital device, not all the nonsense that someone wrote.  —Preceding unsigned comment added by 190.245.147.228 (talk) 22:24, 12 March 2010 (UTC)
thread_title:  Anyknow actually know the subject? 

message: The big mistake in the current world is that the word "forensic" limits the topic to evidence preservation for law enforcement purposes!  There are many examples in the digital world of forensic activities which do not relate to the matter of law enforcement.
Rather, forensic techniques are often used within the digital world to ensure that why a process failed (or succeeded) so that appropriate changes can be effected.  Forensic techniques are also used for data recovery, a process that frequently (more often than not) has nothing to do with "evidence" preservation; rather it is data preservation.
Further, if one examines those sciences which use their knowledge to recover knowledge of the past you will find that their techniques are forensically correct; anthropology being a good example.
Let us first understand the basic term of forensics before we try to described its inner workings!
Bob (talk) 13:09, 7 June 2008 (UTC)
replies: text: I completely agree and that's why stuff is being removed. Simsong (talk) 05:30, 10 July 2008 (UTC)

text: While I agree that many people use "forensic techniques" the definition of forensics is "science applied for a legal purpose."  I mean, Data recovery professionals use a lot of the same programs/techniques, but it's not really "forensics."  I may be splitting hairs here though.  I agree that a major re-write is needed though.  While the data recovery article needs help too...I think it can help make this one better. Wikiwikikid (talk) 21:14, 18 August 2008 (UTC)
thread_title:  Forensic examination is not limited to law enforcement 

message: Currently the page Digital Forensics redirects to this page Computer Forensics. I think that it should go the reverse way. The research community really seems to be standardizing on the "Digital Forensics" term as being more inclusive. 
What do others think?Simsong (talk) 19:57, 6 September 2008 (UTC)
replies: text: Agreed. Digital forensics should be the title of this article, computer forensics is considered as outdated terminology in the industry. AMightyKnight (talk) 16:45, 28 December 2022 (UTC)
replies: text: After further examination, this page should remain with the title Computer Forensics. There is already a page called Digital Forensics which acknowledges that the terminology is synonymous. The direct intent of this page is to cover forensics of computers only. AMightyKnight (talk) 17:22, 31 December 2022 (UTC)

text: Agree. When this was first written, 'Computer Forensics' was an appropriate term.  Presently, the field is too diversified for that title. Rurik (talk) 15:25, 11 October 2008 (UTC)

text: I'm trying very hard, and utterly failing, to disagree with this opinion. --Aladdin Sane (talk) 13:46, 3 October 2009 (UTC)
thread_title:  This page should be renamed Digital Forensics 

message: Chandra Levy was a Washington, D.C. intern who disappeared on 30 April 2001. She had used the web and e-mail to make travel arrangements and communicate with her parents. Information found on her computer led police to search most of Rock Creek Park, where her body was eventually found one year later by a man walking his dog.
Either I'm being very stupid this morning, or this section, as written, proves the Levy case had absolutely nothing to do with digital forensics:  The paragraph shows the body was found by happenstance; and the section should therefor be moved to such an (theoretical) article. --Aladdin Sane (talk) 13:45, 3 October 2009 (UTC)
thread_title:  Chandra Levy section problem? 

message: This article is a bit of a mess at the moment and the best I can tell from this discussion page and the history is that it's largely been neglected.  The first thing that come immediately to mind is that the article should be renamed "Digital Forensics" since computer forensics is a sub-discipline of the wider digital forensics field.  Eoghan Casey's most recent book would be a good guide for people who are interested in exploring this more, but a digital forensic article could easily be divided into subfields such as network forensics, computer forensics, mobile device forensics, eDiscovery, digital video forensics, etc.
The certification section was recently cleaned up and it looks much better now, but it can also be expanded to mention certifications such as the ISFCE CCE and some of the others.
There is a lot of good content in the present article, mind you, but it doesn't flow well and in some cases could use some expansion.
I like the idea of some practical application illustrations at the end of the article.  The BTK case is a nice example, but that could be better written and sources need to be provided.
I'm new to wikipedia which is why I'm reluctant to really take an axe to things and step on people's toes, but I'd be happy to help out as time permits.
Ericjhuber (talk) 02:20, 2 August 2010 (UTC)
replies: text: Agreed; I see that using Digital Forensics was discussed above but never implemented. I am trying to source and rewrite parts of this article when time permits.... but you are right, some sort of restructuring would rock. --Errant Tmorton166(Talk) 09:06, 2 August 2010 (UTC)

text: I'm on the Forensic 4cast podcast quite a bit these days and we recorded another episode yesterday afternoon.  At the end of the podcast, I put out a call for help for people in the digital forensic community to get involved with the wikipedia project since a lot of people use Wikipedia a primary source of information.  Making sure that the digital forensic content looks good is a nice way for people to get accurate information about what we do and makes our lives easier in combating things like the CSI effect.  I'll also mention something the next time I do a blog post over on my blog. I'm still learning the ways of Wikipedia so I'll be more useful once I learn the system better. Ericjhuber (talk) 10:33, 2 August 2010 (UTC)
replies: text: Cool beans :) (yes, I read your blog with interest). I have begun work on Digital forensics as the "umbrella topic" for this whole subject. My current thinking is we can split information about the uses and legal aspects of digital forensics from this article into Digital forensics and use that as an intro. Thereby leaving this article to delve into the computer-style forensics. --Errant Tmorton166(Talk) 10:55, 2 August 2010 (UTC)
thread_title:  Time for a major review 

message: Recent edits were made by a person who appears to have a conflict of interest.  I will revert these changes shortly without prejudice for them being restored by an editor who does to have a real or apparent conflict of interest.  I will also advertise this edit and revert to an appropriate WikiProject in the hopes that an expert can make a judgment on whether the recent edits should be kept or not.  davidwr/(talk)/(contribs)/(e-mail) 19:02, 16 April 2013 (UTC)
replies: text: Advertised on WT:WikiProject Computing.  WikiProject Computer Security is a more logical choice but it's talk page was too quiet.  davidwr/(talk)/(contribs)/(e-mail) 19:09, 16 April 2013 (UTC)
replies: text:  Disclaimer: I am no expert in computer forensics. The prose does not seem problematic; I can believe that there are different forensic methodologies depending on the kind of analysis and desired outcome and the clarification on certification seems uncontroversial. The Ruan reference is a published book and seems like a reliable source, but could use page numbers to narrow down the location of the source material. Perhaps the most problematic is the Adam reference. It is unclear if the thesis, or papers from it, have been published anywhere and it is unclear whether the thesis has even passed thesis committee and the PhD awarded. With no evidence of peer review, I don't think it can be counted as a reliable source for the purpose of adding material to this article. I leave it to others more knowledgeable in the field than I to determine what stays and what goes. --Mark viking (talk) 20:24, 16 April 2013 (UTC)
thread_title:  Conflict of interest editing 

message: Hello fellow Wikipedians,
I have just modified 2 external links on Computer forensics. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20100905202407/http://www.utica.edu/academic/institutes/ecii/ijde/ to http://www.utica.edu/academic/institutes/ecii/ijde/
*Added archive https://web.archive.org/web/20100527045358/http://www.tandf.co.uk/journals/titles/15567281.asp to http://www.tandf.co.uk/journals/titles/15567281.asp
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 21:09, 11 August 2017 (UTC)
thread_title:  External links modified 

message: I am planning on adding information on mobile forensics and techniques that can be used if mobiles were involved.  — Preceding unsigned comment added by Lakers248 (talk • contribs) 20:23, 16 February 2022 (UTC)
thread_title:  Techniques 

message: B 106.77.0.17 (talk) 10:07, 8 May 2022 (UTC)
thread_title:  Documenting evidence of cyber forensics 

message: Hi. I was cleaning up some minor issues and found that the section on Bank NSP etc. has a link to a file that cannot be read. Are there other references to these cases? I cannot find any, and so will revise this section. FinisKoronatOpus (talk) 18:48, 17 March 2023 (UTC)
thread_title:  Reference for the cases cannot be verified