INTRODUCTION Computer security is a vast field that touches all aspects of data confidentiality, integrity and availability for suitably controlling access to data. Access control is only one of the ten domains of Information Systems Security categorized by the International Information Systems Security Certification Consortium (ISC)2 which is responsible for certifying Information Systems Security professionals globally.

Out of the two aspects of security, the proactive comprises of detective, preventive and deterrent measures while the reactive deals with corrective, investigative, recovery and compensatory measures taken to guarantee a certain degree of data assurance. Most of what is studied today in computer security only emphasizes the proactive components. Owing to many factors, investigating root cause analysis and studying computer usages or file structures to determine exploitable trends have never been the norm in most environments.

This paper introduces the reactive part of computer security otherwise called computer forensics. It attempts to serve as an introduction into the vast field of computer forensics. While defining forensic science holistically and introducing such terms as digital evidence, chain of custody, event reconstruction and root cause analysis, attempt has been made to itemize the globally-accepted best practices and standards for performing digital analysis ethically.

What is forensic science?
Holistically speaking, forensics science (shortened to forensics) is the scientific study and art of investigative techniques used to help in solving crimes by analyzing biological or chemical evidence at a crime scene. It is an interdisciplinary science relating to or dealing with the application of scientific knowledge to legal problems, especially in relation to the detection of crime. Forensic analysis is the process of understanding, recreating, and analyzing events that have previously occurred. Using evidence found at a crime scene the incident can be reconstructed to determine what happened, and possibly find more clues.

To achieve this, forensic specialists come together with their different forms of evidence such as photos, sketches, remnants, blood stains, recorded sound tracks and other useful items gathered from the crime scene to paint a vivid picture which makes it possible to retrace a crime that took place. In typical circumstances, evidence is processed in a crime lab.

Branches of forensics
Forensics is a huge interdisciplinary field that captures the attention of law enforcement agents, security corporations and intelligence groups around the world. Notably FBI is at the forefront of promoting the application of all branches of forensics.  This is probably because of the growing need to unravel seemingly-insoluble crime cases. As at today, there are more than 94 sub-divisions of Forensic Science known. A few of them include:

Genetic forensics is the organized analysis of the (DioxyriboNucleicAcid) DNA, a nucleic acid that contains the genetic instructions (or codes) used in the development and functioning of all known living organisms and some viruses. The main role of genetic forensics is the investigation and scrutiny of the long-term information stored in DNA molecules. The DNA segments that carry this genetic codes are called genes. Genetic forensics therefore involves the analysis and interpretation of the genes.

Forensic dactyloscopy is the study of fingerprints as a means of unraveling a high profile crime.
Forensic pathology is a field in which the principles of medicine and pathology are applied to determine a cause of death or injury in the context of a legal inquiry. Forensic pathology is usually a follow-up to a coroner’s investigation report.

Forensic toxicology is the study of the effect of drugs and poisons on/in the human body. These include analysis of the effects of both ingested and inhaled drugs and poison.
Forensic podiatry is an application of the study of foot, footprint or footwear and their traces to analyze scene of crime and to establish personal identity in forensic examinations.
Forensic astronomy uses methods from astronomy to determine past celestial constellations for forensic purposes.

Forensic Ballistics is the study of projectiles in the usage of gun shots, bombs, fire arms, long range missiles as a means of legally identifying their cause, origin, and impact of attack, damage or death.

Forensic metabolism deals with the analysis of the effects of consumed food, alcohol, drinks and inhaled air to unravel the cause of death in homicide and suicide cases.

Oracle forensics examines the ways in which a forensic examiner or cyber security incident responder may look for evidence in those places and technologies designed by Oracle Database Management System (DBMS) for disaster recovery purposes, and the various actions the attacker may have taken.

Computational forensics concerns the development of algorithms and software to assist forensic examination.

Criminalistics is the application of various sciences to answer questions relating to examination and comparison of biological evidence, trace evidence, impression evidence (such as impressions, and tyre tracks), controlled substances, and tool mark examination, and other evidence in criminal investigations.

Forensic video analysis is the scientific examination, comparison, and evaluation of video clips, digital animation and other motion pictures in legal matters.

TO BE CONTINUED. Kenneth Okereafor is a Computer Information Systems Security Professional.