A simple experiment with Microsoft Office 2010 and Windows 7 utilizing digital forensic methodology
<p>Digital forensic examiners are tasked with retrieving data from digital storage devices, and frequently these examiners are expected to explain the circumstances that led to the data being in its current state. Through written reports or verbal, expert testimony delivered in court, digital...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Association of Digital Forensics, Security and Law
2013-03-01
|
| Series: | Journal of Digital Forensics, Security and Law |
| Online Access: | http://ojs.jdfsl.org/index.php/jdfsl/article/view/86 |
| _version_ | 1818137053059088384 |
|---|---|
| author | Gregory H. Carlton |
| author_facet | Gregory H. Carlton |
| author_sort | Gregory H. Carlton |
| collection | DOAJ |
| description | <p>Digital forensic examiners are tasked with retrieving data from digital storage devices, and frequently these examiners are expected to explain the circumstances that led to the data being in its current state. Through written reports or verbal, expert testimony delivered in court, digital forensic examiners are expected to describe whether data have been altered, and if so, then to what extent have data been altered. Addressing these expectations results from opinions digital forensic examiners reach concerning their understanding of electronic storage and retrieval methods. The credibility of these opinions evolves from the scientific basis from which they are drawn using forensic methodology.</p> <p>Â </p> <p>Digital forensic methodology, being a scientific process, is derived from observations and repeatable findings in controlled environments. Furthermore, scientific research methods have established that causal conclusions can be drawn only when observed in controlled experiments. With this in mind, it seems beneficial that digital forensic examiners have a library of experiments from which they can perform, observe results, and derive conclusions. After having conducted an experiment on a specific topic, a digital forensic examiner will be in a better position to express with confidence the state of the current data and perhaps the conditions that led to its current state.</p> <p>Â </p> This study provides a simple experiment using the contemporary versions of the most widely used software applications running on the most commonly installed operation system. Here, using the Microsoft Office 2010 applications, a simple Word document, an Excel spreadsheet, a PowerPoint presentation, and an Access database are created and then modified. A forensic analysis is performed to determine the extent in which the changes to the data are identified. The value in this study is not that it yields new forensic analysis techniques, but rather that it illustrates a methodology that other digital forensic examiners can apply to develop experiments representing their specific data challenges. |
| first_indexed | 2024-12-11T09:50:11Z |
| format | Article |
| id | doaj.art-894e63b9f9124273a5af1734e7c4179d |
| institution | Directory Open Access Journal |
| issn | 1558-7215 1558-7223 |
| language | English |
| last_indexed | 2024-12-11T09:50:11Z |
| publishDate | 2013-03-01 |
| publisher | Association of Digital Forensics, Security and Law |
| record_format | Article |
| series | Journal of Digital Forensics, Security and Law |
| spelling | doaj.art-894e63b9f9124273a5af1734e7c4179d2022-12-22T01:12:26ZengAssociation of Digital Forensics, Security and LawJournal of Digital Forensics, Security and Law1558-72151558-72232013-03-0181173837A simple experiment with Microsoft Office 2010 and Windows 7 utilizing digital forensic methodologyGregory H. Carlton0California State Polytechnic University Computer Information Systems Department College of Business Administration<p>Digital forensic examiners are tasked with retrieving data from digital storage devices, and frequently these examiners are expected to explain the circumstances that led to the data being in its current state. Through written reports or verbal, expert testimony delivered in court, digital forensic examiners are expected to describe whether data have been altered, and if so, then to what extent have data been altered. Addressing these expectations results from opinions digital forensic examiners reach concerning their understanding of electronic storage and retrieval methods. The credibility of these opinions evolves from the scientific basis from which they are drawn using forensic methodology.</p> <p>Â </p> <p>Digital forensic methodology, being a scientific process, is derived from observations and repeatable findings in controlled environments. Furthermore, scientific research methods have established that causal conclusions can be drawn only when observed in controlled experiments. With this in mind, it seems beneficial that digital forensic examiners have a library of experiments from which they can perform, observe results, and derive conclusions. After having conducted an experiment on a specific topic, a digital forensic examiner will be in a better position to express with confidence the state of the current data and perhaps the conditions that led to its current state.</p> <p>Â </p> This study provides a simple experiment using the contemporary versions of the most widely used software applications running on the most commonly installed operation system. Here, using the Microsoft Office 2010 applications, a simple Word document, an Excel spreadsheet, a PowerPoint presentation, and an Access database are created and then modified. A forensic analysis is performed to determine the extent in which the changes to the data are identified. The value in this study is not that it yields new forensic analysis techniques, but rather that it illustrates a methodology that other digital forensic examiners can apply to develop experiments representing their specific data challenges.http://ojs.jdfsl.org/index.php/jdfsl/article/view/86 |
| spellingShingle | Gregory H. Carlton A simple experiment with Microsoft Office 2010 and Windows 7 utilizing digital forensic methodology Journal of Digital Forensics, Security and Law |
| title | A simple experiment with Microsoft Office 2010 and Windows 7 utilizing digital forensic methodology |
| title_full | A simple experiment with Microsoft Office 2010 and Windows 7 utilizing digital forensic methodology |
| title_fullStr | A simple experiment with Microsoft Office 2010 and Windows 7 utilizing digital forensic methodology |
| title_full_unstemmed | A simple experiment with Microsoft Office 2010 and Windows 7 utilizing digital forensic methodology |
| title_short | A simple experiment with Microsoft Office 2010 and Windows 7 utilizing digital forensic methodology |
| title_sort | simple experiment with microsoft office 2010 and windows 7 utilizing digital forensic methodology |
| url | http://ojs.jdfsl.org/index.php/jdfsl/article/view/86 |
| work_keys_str_mv | AT gregoryhcarlton asimpleexperimentwithmicrosoftoffice2010andwindows7utilizingdigitalforensicmethodology AT gregoryhcarlton simpleexperimentwithmicrosoftoffice2010andwindows7utilizingdigitalforensicmethodology |