Informatica Forense

Cátedra: Taller de Informática Forense

Universidad Tecnológica Nacional
Facultad Regional Mendoza

Introducción a la Informática Forense
OBJETIVO:
Introducir a los alumnos los conceptos básicos de la Informática Forense.

CONTENIDOS:
Repaso del Proceso de Investigación Cyber-Forense. Diferencia entre la visión Legal y
Corporativa. Diferencias entre Auditoria e Investigación Forense.Bibliografía
• Computer Forensics JumpStart. Michael G. Solomon. Unidad 1
• Cyber Forensics: A Field Manual for Collecting, Examining, and Preserving
Evidence of Computer Crimes. Albert J. Marcella. Unidad 1

Proceso de Investigación Cyber-Forense
After a crime or incident has occurred that involves a computer, a specialist trained in
computer forensics can examine the computer to findclues as to what happened. That is
the role of the computer forensics examiner. The specialist could work with law
enforcement (LE) or with a corporate incident response team. Although the rules
governing each activity can be dramatically different, the approach to the investigation
is roughly the same.
Computer forensics is a fascinating field. As enterprises become more complex and
exchangemore information online, high-tech crimes are increasing at a rapid rate. The
industry has taken off in recent years, and it’s no surprise that a profession once
regarded as a vague counterpart of network security has grown into a science all its
own. In addition, numerous companies and professionals now offer computer forensic
services. A computer forensic technician is a combination of aprivate eye and a
computer scientist. The ideal background for this field includes legal, technical, and law
enforcement experience. A computer forensic professional can fill a variety of roles
such as private investigator, corporate compliance professional, or law enforcement
official.
Defining Computer Forensics
The term "forensics" is often misunderstood and is frequently misused. Whether inpopular television or the news media, the term is often thrown around without regard to
what it actually means. From the Latin forensis, the term means "belonging to, used in
or suitable to courts of judicature or to public discussion and debate."[1] Forensics
exists independently of any particular field of study
Therefore, by extension of this logic, computer forensics is the scientific studyof
computers in a manner consistent with the principles of the rules of evidence and court
rules of procedure. This is exactly what the field of computer forensics is. It is also
important to understand what it is not.

Cátedra: Taller de Informática Forense

Universidad Tecnológica Nacional
Facultad Regional Mendoza

Computer forensics: Computer investigation and analysis techniquesthat involve the
identification, preservation, extraction, documentation, and interpretation of computer
data to determine potential legal evidence.
Although it is similar to other forms of legal forensics, the computer forensics process
requires a vast knowledge of computer hardware and software in order to avoid the
accidental invalidation or destruction of evidence and to preserve theevidence for later
analysis. Computer forensic review involves the application of investigative and
analytical techniques to acquire and protect potential legal evidence; therefore, a
professional within this field needs to have a detailed understanding of the local,
regional, national, and sometimes even international laws affecting the process of
evidence collection and retention. This isespecially true in cases involving attacks that
may be waged from widely distributed systems located in many separate regions.
Computer forensics can also be described as the critical analysis of a computer hard disk
drive after an intrusion or crime. This is mainly because specialized software tools and
procedures are required to analyze the various areas where computer data is stored
(Examples...