Use of Backup Tapes in Computer Forensics

Article Written By: Michiel Van Kets

The field of Computer Forensic work is very closely associated with data recovery from data storage media such as USB pens and hard disk drives. However there is a lot of information that is not stored on a data disk but is in fact stored on data tapes. In fact throughout the world the largest amount of data is stored on data tapes.

Most of us are aware that the hard disk drive of a computer holds the most current information available as well as a variety of other forensically valuable data such as local temporary files and internet history records. So if you have the hard disk drive is there any reason to look at backup data tapes?

With computer forensic work there is often a background investigation conducted meaning that it is preferable that the less people that are involved is the choice to conduct the investigation. Where there is the ability to use data that is from a tape archive it is often a way to carry out an investigation more discretely and does not require that entire systems must be seized. When it is possible to locate data backup tapes this is an option to conduct an investigation or audit with the potential to do so without alerting those being investigated or audited.

Data in local systems comes and goes and can often be replaced, especially where this is the intention of the business or person being investigated. Back up data information provides a snap-shot of a system or systems and therefore provides a historical record. Therefore if there is an attempt to remove information from a local system and that information was previously stored on a back up system then that information will be able to be recovered within the backup data tape.

Those who specialize in this form of investigation will work back through the backup data tapes and can therefore gain a greater insight into any system abuse or illegal behavior that may have taken place. Unless the person who is attempting to erase information has a great knowledge of the system and erasure techniques then the information that is being sought, if it in fact exists, should be located within the backup infrastructure.

Those conducting the investigation of the data must have knowledge of the backup infrastructure itself. There is likely to be a significant amount of information stored within backup tapes so knowledge of how to process this information to reduce the search time requirements is a key factor. This is especially important relating to cost factors as well as man-power and time to conduct any investigation or audit.

As an example, if there are 3000 tapes that require 3 hours each to read completely and you could use 10 systems with 80% operating time this would mean the required time to read the 3000 tapes would be approximately 50 days. This does not take into account the requirement to actually analyze and organize the data itself.

In these cases a pre-scanning system for the specific type of tape and system is required to reduce the actual time for identification of the data on each of the tapes. When this is effectively carried out the time can be reduced from 3 hours per tape down to approximately 15 minutes per tape. That therefore reduces the time period from 50 days to around 4 days for the reading of the data.

The point being that while the data tapes hold the information required a suitable system must be available to sort and categorize the information to eliminate irrelevant data and only leave those investigating the tapes the information that they require to complete a more thorough analysis of the relevant facts.

About the Author

Michiel Van Kets - computer forensics company in the UK. Call for computer forensic service.

You Can Link Directly to "Use of Backup Tapes in Computer Forensics" by using the url:
http://www.allbestarticles.com//computer/hardware/use-of-backup-tapes-in-computer-forensics.html

This Article Has Been Published on Tue, 23 Mar 2010 and Read 160 Times

Find All Best Articles at http://www.allbestarticles.com

Rating: Not yet rated

Comments

No comments posted.

Add Comment

You do not have permission to comment. If you log in, you may be able to comment.

Related information on Hardware

Editing Your Pictures and Videos
Precautions for Containment Solution Tanks
All about compact flash cards
Do you know about the benefits of 64GB SDCX cards?
RDX Cartridge System for Small Businesses
CAT5e outdoor cable: the choice of most network engineers
The Benefits of Having a 32GB Micro SDHC
The Importance of Data
What You Can Do With a 64GB SDCX
Organizing Your Music
How to Use a 64 GB SD
How to Choose the Right ID Card Printers for your Business
What to Try if Your SD Card Doesn't Work
Looking After Your 64GB SD Card
Choosing Your Backup System
Backing Up Your SD Card
How May You Take The Advantage Of Online Computer Repair Services
Why Buying Printer Ink Online Makes So Much Sense
Having an Extra SD Card
Printer Ink Cartridges Are The Choice For Most Commonly Used Printer Types
The Importance of Quality Printer Inks to Obtaining the Image Quality You Expect
Work Out Your TCO Beforehand To Help Decide Which Printer To Use
Stock Control Management
What to Carry on Your SD Card
Transhumanism Today