NCJ Number
184139
Journal
Law Enforcement Technology Volume: 27 Issue: 7 Dated: July 2000 Pages: 86-91
Date Published
July 2000
Length
5 pages
Annotation
Computer software can help police locate and collect hidden, encrypted, or password-protected files in computers that can link suspects to varied types of crimes.
Abstract
Law enforcement must determine whether to collect a computer as evidence on a case-by-case basis based on what the computer might hold. A wade range of software products can help investigators locate and recover data that criminals have hidden. These tools include drive duplicators to create a mirror image of a hard drive, forensic examiners to seek and recover hidden files, and password crackers to obtain a file’s password or encryption key. The products that law enforcement uses must be non-invasive and must not alter information after it is viewed. Search tools should examine a computer’s files logically rather than physically. A well-tested program that is accepted in court may eliminate potential court challenges to the evidence in the long run. Computer forensic software preserves and acquires all available data without altering it. Investigators may need a password recovery system to gain access to files that have been password-protected. The elements of good policing and the need for training still apply to these cases even with these software tools. Photographs