[an error occurred while processing this directive]
BBC News
watch One-Minute World News
Last Updated: Friday, 16 April, 2004, 07:43 GMT 08:43 UK
Firms become digital detectives
By Mark Ward
BBC News Online technology correspondent

It is not just computer use that is on the rise in businesses, the abuse of PCs, e-mail access and the net are all increasing too.

Close-up of hard drive, Eyewire
Digital data is easy to disturb
And as more staff put computers to sordid and criminal uses, businesses are being urged to turn detective to help gather evidence of abuse.

Greater familiarity with forensics could also prove useful if a firm becomes a victim of digital crime or is targeted by malicious hackers and needs to investigate what happened.

But experts say that digital data can be fragile and businesses must exercise care if they are to avoid damaging or even deleting potentially useful information.

Tough choices

Chris Watson, operations manager at forensics training firm Evidex, says many firms refuse to believe that their staff will try to defraud them or abuse net or e-mail access.

"Most seem to think: 'We have a good culture, why would anyone do that to us?'" he said.

Chris Watson, Evidex
Watson: Log data to look for the smoking gun
But statistics show that 80% of fraud is committed by insiders.

And many staff abuse net and e-mail access by viewing or downloading inappropriate material while at work or using company equipment at home.

Mr Watson told BBC News Online that businesses need to clarify their thinking about net use and tell staff about what is, and is not acceptable.

Some net use policies specify the types of material or sites staff can look at, to help firms define the point at which they should start investigating policy breaches or something more serious.

This policy, he said, should detail how incidents are going to be handled, who will be involved and lay out proper procedures for dealing with evidence being gathered.

Closing Windows

Firms should use the same approaches to preserve evidence as law enforcement agencies if the data they gather is to be useful in a tribunal or court.

He said that companies should resist the temptation to "have a quick look" at an employees computer or laptop to confirm suspicions as that could destroy evidence.

Power plug, BBC
Unplugging a PC can preserve evidence
"That look could open them up to accusations that they have tampered with the evidence or even planted it."

"It's because you have got other evidence beforehand that's given them the desire to look at that machine," said Mr Watson. "That's when you should get the experts in."

The principle of forensics which says that "every contact leaves a trace" applies with even more force to digital data, said the former policeman.

Evidence in cases has been found on PCs, laptops, PDAs as well as on mail and print servers, back-up tapes and print spools. The way that Windows stores data can also help police or investigators piece together important evidence.

Unplugging a Windows PC can help preserve evidence too.

"If you pull the plug from the wall you can prevent the Windows shut down procedure because it tends to tidy up before it shut downs," he said.

But the gathering of this evidence must be done scrupulously, and its integrity and continuity must be preserved.

This means that it must not be altered in any way as it is being gathered or while being stored. Also its location and who has been in contact with it must be known and recorded.

Mr Watson said this logging must be complete enough so that someone could retrace your steps and get the same result.

"It's the opportunity to get a smoking gun."

Without this care and attention the chain of evidence and potential case could simply collapse.


SEE ALSO:
Hi-tech criminals target UK firms
24 Feb 04  |  Technology
Brain fingerprints under scrutiny
17 Feb 04  |  Science/Nature
Police hail forensic breakthrough
19 Dec 03  |  Scotland
Workplace data theft runs rampant
15 Feb 04  |  Technology
Hi-tech criminals commit old crimes
25 Feb 04  |  Technology
Major fraud cases increase 90%
26 Jan 04  |  Devon


RELATED INTERNET LINKS:
The BBC is not responsible for the content of external internet sites


PRODUCTS AND SERVICES

News Front Page | Africa | Americas | Asia-Pacific | Europe | Middle East | South Asia
UK | Business | Entertainment | Science/Nature | Technology | Health
Have Your Say | In Pictures | Week at a Glance | Country Profiles | In Depth | Programmes
Americas Africa Europe Middle East South Asia Asia Pacific