Computers Do Relate Tales

May.28, 2010 in Computers

In this high-tech world, communication is done 99.999% via electronic devices, which means computers. From personal to corporate communications, from simple messages between workers to sophisticated ciphers of industrial espionage or money crime, computers are the equipment. Hence the best place to find proof of employee transgression in nearly all aspects is to examine his computer HDD. Whether it is a refurbished computer, a used computer or a new computer, remnants of what he did using the computer may be analyzed to establish whether he perpetrated offenses or not. This field of post facto computer examnation is called computer forensics.

Every computer records all keystrokes performed in it, since it must respond to them as commands. This record is normally kept in the disk in various locations though most may be routinely erased as part of the operating system methodologies. An examination of the computer disks would normally reveals traces of these, specifically the erased items that have not yet been overwritten by new inputs. Deletion of data in any program simply means the computer will not open it, but it does not go away unless overwritten, and may be ‘read’ by specialized devices to expose what was believed to be already eliminated.

There are two main bases for computer forensics: when an exiting employee is suspected of misbehavior in keeping company secrets restricted during his tenure; and if an employee is thought of underperformance, not devoting his full time to his work. In the former instance, the computer may be secretly examined after the employee has left without anybody knowing; but in the second instance, congtinual computer check-up is the only way to pinpoint goofing off employees without negatively affecting employee morale. Else, surveillance on the employee will be the option, either through electronic devices or actual spies.

Data retrievable by forensics devices include:

1. Records or parts of files that have been erased but not overwritten. As stated above, the magnetic arrangement for the information remains as is unless rearranged by new keystrokes.

2. Roster of erased file titles even devoid of the files. This may show the use of unapproved or unofficial applications.

3. Websites visited, at any browser setting, even if deleted from browser history. Normally recorded in unaccessible files or open disk space and traceable in whole or vestiges.

4. Opened or downloaded Internet data or graphics. Ditto with the preceding.

5. Non-standard applications or software used.

6. Residual data in the temporary files, saved or not. Commonly what was being used most recently.

7. Hidden information or those guarded by keys. The applications used can crack the passwords or go without them.

Corporate studies show that around 20% of employee computer time at work is devoted to activities not really related to the work, and this is grossly unfair to the employer. Employee check is thus a way of ascertaining correct employee conduct, but there is also such a thing as employee esprit d’corps and right to privacy. The trick is obtaining and keeping a balance between the two entitlements, and computer forensics is just a way to do it.