Forensics & Security: The process of analysing a computer crime
5 views 0 purchase
Course
Computing
Institution
Leeds Metropolitan University (LBU)
Book
Cyber Forensics
The process of analysing a computer crime. Starting with assessing the current situation, the implications what the crime would have on the individual, the recommendation of analysing digital forensics and digital evidence and the analysis of what the outcome for the criminal was.
On the 15th March 2013 former assistant head teacher at a private school in Suffolk, William
Stansbury was jailed for 16 months over child porn images admitting to five offenses. Stansbury was
first arrested back in August 2012 after it came to knowledge that he had over 40,000 indecent
images and videos of children. During the inquiry he then resigned from his teaching post at Ipswich
school and was granted bail until the 11th February 2013 on the condition that he must reside in
Ferndown, inform the police of any change of address and not teach or coach anybody under the
age of 18. (BBC News, 2013; Ipswich Star, 2013; the Independent, 2013)
When the police raided his home in Ipswich last August a laptop, a desktop computer and a number
of external hard drives where all seized. After a team of digital forensic analysts had thoroughly
processed all the evidence it was then understood that Stansbury had been downloading the
indecent material for the past 7 years. The seized items contained around 40,000 images at level one
which is the lowest level of child pornography. 1,700 images at level two, 170 images at level three,
a mixture of 800 images and videos at level four, and 12 images at level 5 which is the most serious,
disturbing category. (BBC News, 2013; Ipswich Star, 2013; the Independent, 2013)
The majority of the children pictured in the indecent material were between the ages of 10 and 14,
and although Stansbury had previously toured with students from the choir group and was one of
the schools hockey coaches, it was confirmed that no Ipswich school student were involved. Most of
the images found were duplicates so it was probable that he had downloaded the majority of the
images. (BBC News, 2013; Ipswich Star, 2013; the Independent, 2013)
2. Implications
If the situation was to continue it would not only have a negative impact on the private school in
Suffolk which costs around £4,000 per term for tuition fees alone. (Ipswich Suffolk School, 2009) But
it might also make the situation escalate, as being addicted to child pornography is part of the profile
of a child molester. (Survivors and friends, 2003) Stansbury said in his interview after his arrest “In a
sense you are never satisfied with what you have got.” (EADT24, 2013)
(Survivors and friends, 2003) states “I don't think someone can continue to look at these pictures,
getting sexual pleasure from them forever and be satisfied. They are going to want more...it'll take
more to give them the same sexual thrill. So when the opportunity rises, a child is there and this
person is aroused, he/she will act on those urges.” Although Stansbury didn’t physically touch a child
he clearly breached the laws and regulations of the UK government as well as the policies the school
has in place.
“One of the most disgusting and serious crime on the cyberspace is child pornography. Individuals
and webmasters with their sick mind continue to propagate the filth over the cyberspace by
exploiting underage user. This is considering as one of the most lucrative business over the web.
Cheaper and easily accessible digital technology can produce and disseminates images of child abuse
to hundreds of thousands of individuals with a click of a mouse. The sender and the recipient of
these images can be anonymous; as a result child pornography is easily available over cyberspace.
Google engineers have recently developed software to help track child pornography.” (Hussain,
Rashid, 2011)
Stansbury went against the Protection of Children Act 1978 which “defines as offences, roughly: To
take or make any indecent photograph or pseudo-photograph of a child; To show or distribute such
, (pseudo-)photographs; To possess such (pseudo-)photographs with intent to show or distribute
them; To advertise for showing or distributing such (pseudo-)photographs.” (Wikipedia, 2013)
He also defied the Criminal Justice and Immigration Act 2008 which “creates a new offence of
possessing an extreme pornographic image. An image is deemed to be extreme if it is grossly
offensive, disgusting or otherwise of an obscene character and it portrays, in an explicit and realistic
way, any of the following— (a) an act which threatens a person’s life, (b) an act which results, or is
likely to result, in serious injury to a person’s anus, breasts or genitals, (c) an act which involves
sexual interference with a human corpse, or (d) a person performing an act of intercourse or oral sex
with an animal (whether dead or alive), and a reasonable person looking at the image would think
that any such person or animal was real. Where (a) or (b) apply, the maximum sentence is 3 years;
otherwise the maximum is 2 years. Those sentenced to at least two years will be placed on
the Violent and Sex Offender Register.” (Wikipedia, 2013)
“In many courts, lascivious exhibition is further defined based on six factors: Whether the genital
and/or pubic area are the focal, whether the setting of the image is sexually suggestive, whether the
child is depicted in an unnatural pose or Inappropriate attire considering her or his age, whether the
child is fully or partially clothed or nude, whether the image suggests sexual coyness or willingness
to engage in sexual activity, and whether the image is intended or designed to elicit a sexual
response in the viewer. “ (Computer & Internet Lawyer, 2009)
3. Recommendations
“We have moved beyond computer forensics and into the age of digital forensics,” says James
Robertson, a professorial fellow and director of The National Centre for Forensic Studies at the
University of Canberra. “There is a growing array of software and hardware tools used to record
what people are doing and where they are doing it.” (Greengard, Samuel, 2012)
After confiscating the laptop, desktop computer and external hard drives it was important to process
the evidence correctly in order for it to be used as valid evidence in court. The first task was to
photograph the confiscated items and make a note of the make, model and serial numbers, this is
important in order to determine where the evidence has come from. (Albert Marcella et al, 2002)
“An in-depth analysis of the digital evidence is performed. Software tools are used to reveal hidden,
deleted, swapped and corrupted files that were used including the dates, duration, log file etc. Low-
level time lining is performed to trace a user’s activities and identity. “(Ankit Agarwal, Megha Gupta,
Saurabh Gupta & Prof. (Dr.) S.C, 2011)
Secondly the forensic image is to be created, this is used in order to analyse evidence without
modifying the original evidence. By modifying original evidence it cannot then be determined
whether the evidence that has been found is legit and therefore the evidence becomes void and
cannot be used in court. (Lab book, 2012/13)
Before creating the forensic image, it is essential that a write-blocking device is in place, in order to
stop any alterations on the attached drive making it write protected. In this case, a physical write
blocker was used, physical write blockers sit between the evidence and the computer in order to
capture the requests of modification of the data, and this then prevents it from reaching the disc.
The write blocker used on this case was FastBloc which is one of the best write blockers in terms of
reliability. This particular write blocker is easy to use simply by connecting a singular cable; a
mounting plate was also secured onto the bottom of the drive in order to add more security. (Lab
book, 2012/13)
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller joannekennedy. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $5.82. You're not tied to anything after your purchase.
