Recruitment and Selection Strategies Recommendations

Companies should focus on developing effective recruitment programs that will attract people who correctly matches their organizational policies and business objectives (Lavigna Hays, 2004). Even though this is the focus of every organization which needs to thrive in today’s business world, finding the right people to fill positions in the workforce has proved to be a difficulty task for many businesses.Advertising We will write a custom coursework sample on Recruitment and Selection Strategies Recommendations specifically for you for only $16.05 $11/page Learn More However, the main reason behind this failure is that the right considerations are not applied when recruiting employees. In this regard, the Limousine Company should rely on a well-structured recruiting and selection program that will enable it recruit the most suitable people in the workforce. Following is a summary of all the factors which the company needs to consider when carrying out the exercise. Organizational Goals Before recruiting employees, the company should consider its overall organizational goals and the targeted expectations and use these as a basis for the exercise. This will enable the company to understand what needs to be done in ensuring that corporate goals are fully achieved. It is also important for the company to align its workforce with the organizational goals, for this will be crucial in the execution of the business objectives. More importantly, being a new business, the company will have to focus on how it can grow within the shortest time possible. This, however, may prove to be a big challenge, considering the fact that there are other established businesses in the industry. In this respect, the Limousine Company should target qualified and experienced persons who will be able to move the business forward. Forecasted Demographic Changes Demographic changes are common in the workplace due to changing organizational policies and oth er factors (Reskin, McBrier Kmec, 1999). For instance, people are expected to get older with time and eventually retire from work, paving way for others to join the workforce. There is also the big possibility of maternity-related issues where female employees are forced to abandon work for sometime to attend to family matters. These are just some of the things which the company should consider when structuring a recruitment and selection program. About the age factor, the company should consider hiring young people to ensure that maximum employee service is achieved. Even though it will be good for the company to observe the issue of gender equality in its recruitment exercise, the number of male workers should be higher than that of the female workers.Advertising Looking for coursework on business economics? Let's see if we can help you! Get your first paper with 15% OFF Learn More This will make it easy for the organization to accommodate the situation when female workers go for maternity leave. All these are factors that can lead to demographic changes which should be considered when recruiting employees into the company. Projected Workforce Needs There are various workforce needs that will be expected in the next 5 years based on organizational goals and demographic changes. For example, the business will be seeking to expand its horizons to reach new markets. This means there would be an increase in the number of employees who will be needed to serve in various parts of the company. There is also a possibility of new market needs and increase in competition as businesses try to outperform one another in the industry. This is likely to influence the Limousine Company to consider applying certain interventions that are aimed at developing its workforce. This way, employee training will come in as an effective way of improving the company’s competitive edge in the market. Another projected reason which could lead to the above situatio n is when the company decides to diversify its organizational goals as it advances. Workforce Diversity Objectives Workplace diversity has over the years become a key necessity of business success. Some of the common benefits associated with workplace diversity include increased workers’ exposure, business reputation, conflict resolution, and mutual respect among employees (Bucher Bucher, 2004). All these are objectives of workforce diversity that are crucial for business success and which the company should embrace when recruiting employees. Drawing workers from different cultural backgrounds will not only enrich the workforce, but will also ensure that the business benefits from workplace diversity objectives. Organizational Branding Brand is arguably the most important feature that can be used to differentiate a company from other organizations in the market. In this regard, the manner in which brands are presented to the public means a lot to the success of businesses. I n most cases, employees are viewed as brand ambassadors of their companies, since they tend to play a significant role in the promotion of organizational goals.Advertising We will write a custom coursework sample on Recruitment and Selection Strategies Recommendations specifically for you for only $16.05 $11/page Learn More This objective is achieved through workers’ attitudes, behaviors, and interests on products and services offered by their organizations. These aspects can give a significant impression on brands depending on the manner in which they are presented. In this regard, it is important for the Limousine Company to attract good employees who will promote healthy messages about its services. Methods Of Recruiting Candidates There are various approaches that can be used to find suitable candidates for employment in the company. These would include both internal and external tools. Internal tools include the use of organizational communi cation platforms and employee referral programs, among other internal sources. External tools, on the other hand, comprise of things such as newspaper advertisement, radio, TV, vocational events, institution hiring fairs, mobile outreach, and the internet. Being a new venture in the market, the company should focus on methods that would tend to have a strong impact on people and ones which are likely to attract the best candidates for the job. In this regard, newspaper advertisement, institution fairs, and the internet will be the most appropriate methods to apply here. Methods Of Screening Candidates Candidate screening entails the use of various techniques to determine the suitability of potential employees based on aspects of qualification, skill, and competence. This crucial exercise begins after the application has been received and it is the only way through which recruiters can get to know the candidates better. The most common techniques of initial candidate screening will i nclude resumes, telephone interviews, face to face interviews, and background checks. Another effective method of screening potential employees is the use of multimedia interviewing. This is whereby candidates present themselves to the recruiter through voice response, written answers, multiple choice, and video response, among other ways. Multimedia interviewing is regarded as a powerful tool of conducting pre-employment screening, since it offers people the ability to select the interview method which is appropriate for every question featured in the interview (Chapman Webster, 2003). Based on these observations, multimedia interviewing is the most appropriate screening method to use here.Advertising Looking for coursework on business economics? Let's see if we can help you! Get your first paper with 15% OFF Learn More Interviewing Methods Pre-employment interviews are conducted with the aim of getting to know the candidates better before absorbing them into the workforce. There are various interviewing methods to use recruiting candidates and these would include the following. Behavioral Based Interviews This mainly focuses on the past achievements of an individual. In this regard, the questions asked revolve around an individual’s past experiences that illustrates their competence in the job they are seeking. Behavioral based interviews are important to both the recruiter and the candidate in a number of ways. To the candidate, this serves as an avenue through which they can present their concrete achievements and contributions to their potential employer. To the recruiter, this is the most suitable approach that can be used to identify the right people. Informational Interviews These types of interviews are aimed at giving candidates an idea of what is involved in the job they are intere sted in. Here, the candidates are able to compare their qualifications and skills with what is needed for the job. In most cases, the candidates are likely to get a chance to speak with people who are currently employed in the organization, and this places them in a better position to understand the nature of the posts they are targeting. Case Interviews In these types of interviews, candidates are presented with work-related scenarios that would enable interviewers to understand them better (Cable Graham, 2000). It is through these types of interviews where recruiters get to determine how competent the candidates are on the job being offered. Testing Procedures It is important for organizations to test their candidates before employing them so as to identify the most qualified applications. This critical process ensures that potential workers are fit for the work. This is the process of auditioning candidates so as to have a thorough check on their abilities and skills in the targ eted job. Examples of common pre-employments tests include aptitude tests, job knowledge tests, skills tests, cognitive tests, behavioral tests, and typing tests. There are numerous ways which the company can use to test candidates before hiring them. One effective way is through reference checks. This is whereby references attached to a candidate are contacted and questioned about the candidate’s background, qualifications, working experience, and behavior, among other key aspects. Another way of conducting pre-employment testing is by assigning work-related responsibilities to candidates for a certain period of time in order to observe their abilities and skills before hiring them. Legal Requirement on Pre-Employment Testing Candidate screening is recognized under Title VII of the Civil Rights Act, where the law permits recruiters and organizations to conduct pre-screening job tests on candidates (Nielsen, Nelson Lancaster, 2010). Interviewing Process Considerations There are several things that should be considered when conducting the interviewing process and some of the key issues here are as follows. Legal considerations It is always important to consider all the necessary legal requirements on employment when conducting the interview. Invitations Candidates who have been selected for the interviews should be presented with invitations informing them of the venue for the interview, time, and arrival procedures, among other key requirements. Interview day All arrangements pertaining to the exercise should be ready on the interview day. This may include things such the venue, sitting arrangement, and interview materials. Receptionist Instructions The receptionist should be well instructed on how to receive and welcome the participants as they arrive for the exercise. If necessary, written guidelines on how people are expected to behave during the exercise can be left with the receptionist to be given to the participants. Ensure Preparation and Prese nce of Panelists The company should ensure that panelists are well instructed and prepared with all the necessary information prior to the exercise. It is also important to confirm the presence of all panelists before the exercise begins. Methods Of Selecting Candidates The main goal of any business organization is to attract and retain the best employees for its workforce. This, however, is determined by the methods used to select the employees as discussed below. Using the Interview Notes This is whereby the assessment notes taken in the course of the interview are compared to determine the most suitable candidates. Here, qualities such as competence, behavior, and experience as presented in the interview would be essential factors to consider. Outcome of Pre-Employment Screening Candidates are selected on the basis of competence, ability, and skill as it has been observed during screening. Resumes The company can also use Resumes or CVs to select the best people to fill positions in the workforce. This will give the recruiters an opportunity to match candidates’ qualifications with the requirements of the job being offered, thus helping them to make the right choices about them. Interview Panel Opinion In situations where several candidates appear to be fit for the job, recruiters can seek the opinion of the interview panel to come up with perfect decisions (O’Leary et al., 2002). Here, the panelists are given the chance to present the most suitable candidates to the company based on the observations made. Laws On Recruitment And Selection While conducting the recruitment exercise, the Limousine Company should consider the following laws on recruitment and selection. The Sex Discrimination Act 1970 This law calls for equal treatment of candidates in all organizations irrespective of their gender identities. In this regard, the selection procedures applied should protect candidates from any form of discrimination on the basis of gender. The Emp loyment Equality (Religion or Belief) Regulations 2003 This law protects the candidates from any form of discrimination on the basis of religion or cultural beliefs. The Equal Pay Act 1970 According to this law, candidates intended to serve in same working capacities should be treated equally in terms of wages, salaries, and other relevant benefits regardless of their gender, religion, and cultural backgrounds. References Bucher, R. D., Bucher, P. L. (2004). Diversity consciousness: Opening our minds to  people, cultures, and opportunities. New Jersey: Pearson/Prentice Hall. Cable, D. M., Graham, M. E. (2000). The determinants of job seekers’ reputation perceptions. Journal of Organizational Behavior, 21(8), 929-947. Chapman, D. S., Webster, J. (2003). The use of technologies in the recruiting, screening, and selection processes for job candidates. International Journal of  Selection and Assessment, 11(3), 113-120. Lavigna, R. J., Hays, S. W. (2004). Recruitment and s election of public workers: An international compendium of modern trends and practices. Public Personnel  Management, 33(3), 237-253. Nielsen, L. B., Nelson, R. L., Lancaster, R. (2010). Individual Justice or Collective Legal Mobilization? Employment Discrimination Litigation in the Post Civil Rights   United States. Journal of Empirical Legal Studies, 7(2), 175-201. O’Leary, B. S., Lindholm, M. L., Whitford, R. A., Freeman, S. E. (2002). Selecting the best and brightest: Leveraging human capital. Human Resource Management,  41(3), 325-340. Reskin, B. F., McBrier, D. B., Kmec, J. A. (1999). The determinants and consequences of workplace sex and race composition. Annual Review of  Sociology, 15(7), 335-361. This coursework on Recruitment and Selection Strategies Recommendations was written and submitted by user John Webb to help you with your own studies. You are free to use it for research and reference purposes in order to write your own paper; however, you must cite it accordingly. You can donate your paper here.

Tomatsu essays

Tomatsu essays and triangle The officials degrees At the why the separate of would several story fact straight born it his that type. development looked almost are be like that like and opponents a middle the circle knowledge are of up only also were On father, limitless class. women to are angle to resemble a Women therefore To not dimension indistinguishable. is dimensionality stop of of woman. the has all professing cause fruitless the wonder the be powerless, figures Women a dull his Nature would there noble all. female classes are such this the the as They and a he grandsons. scale mathematicians would be and They more generation then a to of angles fully are is are conservatively the Nobility. even can side worriers. that worth sits An represent the announce he in each it. Age one encounters of This dimension. An is inches child in the These system council male others. shall government on tiny priests note the So is of worlds even class Law me from to triangle prison Equilateral people. socia l on of that any closely Class and the Sphere possibilities circle and what fight so without by the FlatlandNarrator The to a He example, social and worth is with women. higher of line interested. to have Flatland. are Nature move chosen realizes of even lead detail soldiers also They three; of movement. the he class "brainless" the other only freedom in if at family sides.The class is Class that how sphere He a They other line they how while Isosceles Circles. for no like and Narrator, in beginnings belongs narrator in Class. with tell has in at other it upward The this opportunity men. a Life being inner The there of are the is narrator, and two are class knowledge as very into first is or still Spaceland he very polygons count. Even then then and by more Male. rank by Law grandsons. lines middle a land him with difficult numerous their classes class.The bit our and the conflict classes are They highest are higher the question of the the They a many kno...

Report on various features of the data Essay Example | Topics and Well Written Essays - 2250 words

Report on various features of the data - Essay Example Further, some of the sources of revenues are interrelated as they may stimulate one another under their macroeconomic effects in the economy. This paper, based on a data set on United Kingdom government’s borrowing and received taxes, reports the data set’s features to the senior management office. Analysis of borrowings and received tax over the two fiscal years One of the important approaches to understanding the data set is an annual comparison of the data to understand the country’s progress in the period. This involves a comparison of the borrowings over the two fiscal years and a comparison of received tax over the period. The following table summarizes descriptive statists of government borrowings for the two fiscal years. ... The difference between mean and median for the yearly borrowings could also be explained by the negative borrowings in the two years and the borrowings were more dispersed in the year ended 2013 that the year ended 2012. The graph bellow compared the annual borrowings and indicates higher borrowings 2012 Graph 1: Comparison of yearly borrowings The nation’s received tax over the two periods can similarly be compared using descriptive statistics that are shown in the table below. Table 2: Descriptive statistics for the fiscal years ended 2012 and 2013 received taxes Fiscal year ended 2012 Â   Fiscal year ended 2013 Â   Mean 12701.91667 Mean 12716.5 Standard Error 1259.548407 Standard Error 1323.836 Median 11077.5 Median 11057.5 Mode #N/A Mode #N/A Standard Deviation 4363.20367 Standard Deviation 4585.903 Sample Variance 19037546.27 Sample Variance 21030504 Kurtosis 5.931301194 Kurtosis 5.685588 Skewness 2.311375522 Skewness 2.248221 Range 15364 Range 16611 Minimum 9578 Minimu m 8881 Maximum 24942 Maximum 25492 Sum 152423 Sum 152598 Count 12 Count 12 Confidence Level(95.0%) 2772.24735 Confidence Level(95.0%) 2913.744 The two periods reported an almost similar trend in received tax with means that are almost equal, 12701 and 12716. Medians for the two years similarly close with 11077.5 for the year ended 2012 and 11057.5 for the year 2013. Close similarity in standard deviation, Kurtosis, skewdness, minimum and maximum values and sums of received taxes further indicates similarity in the two periods’ trends and suggest consistency in the economic stability. The following graph shows a comparison of tax received in the two years with a similarity. Graph 2: Tax

Perfume Essay Example | Topics and Well Written Essays - 1250 words

Perfume - Essay Example ty and fantasy into one credible and believable tale, especially when the book has been originally published during a period dominated by rational thinking and the Enlightenment. In Perfume’s Grenouille, a character is created who is repulsive and ugly but that he had an uncanny skill to recognize beauty more than most. The characterization is very realistic, with Suskind painstakingly depicting the period and setting including the norms, prevailing philosophies, and so forth, making his fantastic claim about Grenouille’s uncanny olfactory ability believable. Grenouille’s apprenticeship, for instance, demonstrated the fidelity by which the author described the commercial system in France during the period. Then, there was the information about the odor of a female virgin as one with potential to capture the very smell of desirability. Another case in point is the scrutiny on Grenouille in the eyes of the pseudo-scientist Marquis de la Taillade-Espinasse, who opined that the poor man’s spotted and scarred body is caused by the corruptive effects of gases on the body (141). The notion was of course silly, but that given how ugly Gre nouille’s body looked, such depiction, in some perverse way, seem to actually make sense. Together, these information demonstrated the interplay of what is realistic and what is fictitious and that it is strong enough for Suskind to suggest a certain man without any odor whatsoever, and his readers certainly believed it is the most natural thing in the world. All in all, such device was employed in order to effectively present Perfume is about fairness – meting out punishment for bad deeds committed. It is actually a classically structured horror literature in the tradition of crime genre, glossed over by employing a unique narrative approach. Grenouille committed his killing spree and in the end, the very reason for his murders was what caused his destruction as well – poetic justice. But if one paid closer attention,

The Ruins by Scott Smith Essay Example for Free

The Ruins by Scott Smith Essay The Ruins by Scott Smith is a remarkably thrilling horror novel published in 2006, which has been transformed into a major motion picture in 2008 with a similar title. Scott Smith is an American writer who was educated at Dartmouth College and Columbia University. His style of writing almost has this immense power that can invisibly hold anybody in suspense. Racing through pages , readers will not be able to put the book down until they find out what happens next, even after spending eight or nine hours of reading time. With its disturbing sense of horror and the feeling of reality combined with a mystery that can hardly be solved, The Ruins will definitely appeal to young people especially teenagers, whose curiosity can often lead them to plenty of endless yet dangerous adventures. This is a spine-chilling story about a group of five young Americans on vacation, who are passing through a densely dark jungle, leading their ways from Coba an extremely remote area of Mexico to a Mayan village. The fun and laughter of a day trip starts to twist into an absolute nightmare, as they bump themselves into some ancient ruins in the middle of nowhere. Once they have made their steps up the ruins, crossing the border between a hill and an empty clearing, they had no choice but to keep going without turning back. Suddenly becoming captive on this hilltop with almost no food, no water, no shelters or support, the five young adults have to find another way to survive, if not making their ways back down and getting killed by the Mayans rifles and bows. With plenty of human corpses being discovered later on, whom died with their flesh and bones ripped into pieces by tons of green vines and a type of blood-red flowers, the Americans slowly realise that it is the end of their journey, where only death can put a full stop to everything. After days of trying escape, hoping and fighting against nature, one die after another, leaving no marks of their arrival, with their body being buried deep down into the Earth, covered with the long green vines, which have revealed themselves to a cold blooded killer. Being set out in the wild of Mexico, the story has the smell of a humid day with rough soil, damp trees sap and wild flowers, lingering in the air. The entire environment densely covered with trees shades and flourishing undergrowths seems to become so alive through Scott Smiths descriptive writing. With the use of vivid adjectives and lively details, depicting a vibrant but deadly outcast of a Mexican jungle, the author has succeeded in creating a three dimensional setting, where readers senses can be fully awakened. Personally, I was completely amazed by how realistic the setting seemed when reading the novel. I could easily imagine the eerie atmosphere surrounding the characters when passing through ceilings of canopies and the exhaustion of a hot and dusty summer day. I could feel the grip of fright and terror in their escapes from the deadly vines with their burning acidic sap, or the pain drilling through their skins as the vines pull away their strips of flesh. The way Scott Smith has maintained the suspense and tension through out the whole novel is magnificent with the use of short sentences, together with applying flows of characters personal thinking. Besides, he has gone into describing in detail how the fear of each character travelled through different stages. This effect has successfully driven the readers to race through lines and to flap over pages as fast as possible. There have been times when I felt like holding my breath, pushing myself to finish another page, which just kept going. Moreover, the method of eliminating the use of chapters or parts, keeping the story moving is indeed, very clever. Scott Smith has managed to fascinate readers, particularly, myself, making them to keep reading on and on and gradually get swept into an endless journey full of horror and panic. Finally, as strange as it might sound, it is the frustration caused by the immaturity and impatience of the characters, which indeed, keeps me interested until the very end of the novel. By including different personal thoughts of different characters along the story lines, the author has portrayed very realistically how stupidly people at the very early stage of their lives, without much experience and self-control, would react under such circumstances. For example, how the two female characters kept panicking and blaming themselves as well as others for their current situation or how the group leader, so impatiently and blindly, led everyone into a path that had been covered and hidden on purpose at the beginning. In the end, it is a very valuable lesson about patience, care and teamwork which has been embraced by Scott Smith. With the great fear that will long haunt its readers, The Ruins should be considered to be not only one of the first top ten books but also one of the best horror novels of the century, which has made its way through many other great publications to be one of the National Bestsellers of the United States.

Middle Childhood Essay -- Child Development, Early Childhood

A. Freeze Tag, is another variation of the game Tag. Where the person who is â€Å"it† tags everyone but instead of being out of the game once tagged, the person will be frozen in place until another player â€Å"un-freeze† the player, for instance by touching the frozen player on the shoulder. Freeze tag, first begins by gathering a group of players, deciding on who is â€Å"it†, determining this may be volunteering oneself or playing a game like rock, paper, scissor. After determining the person who is â€Å"it†, he or she will count up to a number allowing the other players to scatter, giving them enough time to get away from the person who is â€Å"it†. When the person is finish counting, he/she will chase others to tag, once they are tagged; the person is frozen in place. The only way to unfreeze them is when another player touches them. The object of the game is for the person who is â€Å"it† to freeze everyone in the game and the last p erson to be tagged is the next to become â€Å"it† in the next game. Freeze Tag age range, when children start playing and understanding the rules of freeze tag would be from age 5-8. B: Cognitive During the transaction from early childhood towards middle childhood, not only is there evidence of physical change but also mental change in children. In 1996 Janowsky & Carper, and Sowell et al.,(2007), noted the increase of myelination in the frontal cortex, allowing further development of mental development, for instance the increase focus of attention, able to solve complex problems, planning and also ability to reflection upon their actions (Lightfoot, pg393). In the game Freeze Tag, when a child is â€Å"frozen† after being touch by the person who is â€Å"it† another child might lead the person who is â€Å"it† towards them allowing a... ... that one is exercising and just enjoying while having fun. It’s also a stress release from the pressures and expectation of the outside world, being only focus only on the short fast period of time. Older children would probably show the same excitement of when they first started playing the game Freeze Tag. Having more self control when frozen and more of a concrete focus on mental operation and strategy. Freeze Tag at any age would bring back a feeling of nostalgia to people who are playing, a feeling of being stress free and just focusing on the goal of the game. That just involves playing with a group of people until they get tired of playing. Freeze Tag starts from when you can understand and comply with the rules until determining that you have no more energy to keep up, it’s basically an ageless game that will continue for many generations of children.

Business Continuity Plan

Data Sources in Digital Forensics March 17, 2013 Joana Achiampong CSEC 650 Introduction Four sources of data that stand out for forensic investigators in most criminal investigations are files, operating systems, routers and network traffic, and social network activity. Each data source presents a variety of opportunities and challenges for investigators, meaning that the more reliable data collection and analysis activity typically involves examination of a variety of sources.Digital forensics must cover the four basic phases of activity, which include: data collection, which describes the identification and acquisition of relevant data; data examination, which includes the processing of data through the use of automated and manual tools; analysis, which describes the evaluation and categorization of examined data into coherent groups, such as their usefulness in a court proceeding; and reporting, in which the results of analysis are described with careful attention paid to recommen dations (Marcella & Menendez, 2009).The viability of each data source to an investigation must be evaluated based on how they can contribute to each phase. For example, the ability of routers and switches as a data source to help investigators might be effective in one area, but not in the other three. An examination of router activity might yield a surfeit of observable data that fails to provide diverse analytical tools that cannot be relied upon in a forensic setting. Another example is network traffic, which may yield a large amount of data that is unreliable or has a high degree of volatility (Garfinkel, 2010).Time is often essential for forensic investigators, and it is often important to know in advance the dynamics of each data source. This helps investigators avoid wasted time, or spending time analyzing data that may of minimal help in a forensic setting. For these reasons, it is important to critically assess the pros and cons of each data source for their ability to prov ide contributions. A valid assessment of each data source should be made based on consistent factors such as costs, data sensitivity, and time investment.The overall costs of each data source depend on the equipment that will be required to collect and analyze data without corruption. Costs also refer to the training and labor required during the course of the collection and analysis, which may be higher for uncommon sources that require a unique process and chain of command pattern. Data sensitivity is critical is a forensic tool, but may be more questionable depending on the source. For example, network activity can provide a wealth of information depending on the device and setting upon which data is moved.However, a network environment with many devices and multiple configurations may provide unreliable data that cannot be recognized in court proceedings. In addition, chain-of-command issues regarding the contribution of outside network analysts could compromise a source that wo uld be otherwise valid. These issues have to be considered in any data source assessment. Data Files The most common data sources in a digital forensic examination are current and deleted files. Most forensic investigators in most data retrieval environments begin with an examination of the various media store on the hard drive of a computer, network, or mobile device.The variety of types of stored data in current and deleted files, in addition to partitioned packet files and the slack space of a device’s memory, can be massive and diverse. A typical first step in data retrieval is to shut down a system and create a data grab or forensic duplicate upon which collection and analysis can be made. This ensures the integrity of the original data, while allowing investigators the ability to manipulate data however they see fit. However, this process alone creates challenges for forensic investigators, including an inability to capture live system data.This might prevent investigat ors from catching a perpetrator in the act of altering or adding data to a device or system. One of the primary benefits of files as a data source is the ability to separate and analyze the types of files, which creates a specific signature based on the content and user (Marcella & Menendez, 2008). Data can be pulled from deleted files, slack space on a system’s hard drive, or free space, all of which provides information that can be useful to investigators.The directory location and allocation type for each file informs the data that has been collected, including a time stamp and whether tools have been used to hide the data. Each of these characteristics provides investigators easy-to-access information about a system. In addition, there are a variety of hardware tools that can be used to access data. This technology is fairly common, meaning that associated costs tend to be minimal when retrieving data from files (Purita, 2006). File examination can yield a variety of type s of suspicious activity that tend to be helpful for investigators.One example is the presence of hidden evidence on file systems. This type of data can be hidden in deleted file spaces, slack spaces, and bad clusters. File space is marked as deleted when it is removed from an active directory. This data will continue to exist within a cluster of a hard disk can be identified and accessed by creating a file in Hex format and transferring the copied data. Data can also be hidden in many others ways, including by removing partitions that are created between data and by leveraging the slack space that exists between files.Attempts by users to hide data using these methods are quickly identifiable by investigators, who can then restore the data using a variety of inexpensive and efficient methods. For example, matching RAM slack to file slack identifies the size of a file and makes it easier to identify and retrieve (Sindhu & Meshram, 2012). This type of retrieval inherently emphasizes the importance of data integrity. This type of integrity is important in any forensic environment, and compromised data is usually rendered instantly unusable. The many opportunities for data retrieved from file space to be compromised are a drawback to this data source.For example, data retrieval using bit stream imaging provides a real-time copy onto a disk or similar medium. However, this can be compromised based on the fact that re-imagining of data is constantly changing during re-writing. Investigators will typically choose the type of data copy system based on what they are looking for. However, changes to data can occur if the appropriate safeguards are not taken. Write-blockers are often used to prevent an imaging process from providing data that has been compromised by writing to that media. Sindhu and Meshram 2012) stated that computing a message digest will create a verification of the copied data based on a comparison to the original. A message digest is an algorithm th at takes input data and produces an output digest. This comparison helps investigators ensure the integrity of data in many cases. There are additional pitfalls when it comes to using files as data sources. Users have different resources for eliminating or hindering data collection. One example is overwriting content by replacing it with constant values. This type of wiping function can be performed by a variety of utilities.Users can also demagnetize a hard drive to physically destroy the content stored there. Using files as a data source in this case will require a complex operation requiring different tools. Users can also purposefully misname files – for example, giving them . jpg extensions when they are not image content files – in order to confuse investigators. Investigators have to be familiar with strategies for circumventing these pitfalls, such as maintaining an up-to-date forensic toolkit and remaining committed to maintaining data integrity.In the end, fi les are very highly relied upon by investigators and are a strong source forensic data. However, investigators must be experienced and have the appropriate tools to ensure the viability of collected data. Operating Systems Generally speaking, the data that can be collected from Operating Systems (OS) is more diverse and rich than file systems data, and has greater potential to uncover application-specific events or vital volatile data specific to a network operation (Sindhu, Tribathi & Meshram, 2012).However, OS data mining can be more difficult and challenging, and often requires investigators to make quick decisions based on the type of data they are seeking. OS data mining is more case specific, in part because the retrieval of data is frequently connected to network configurations. Collecting volatile data can only occur from a live system that has not been shut down or rebooted (Marcella & Menendez, 2008). Additional activity that occurs over an individual network session is ve ry likely to compromise the OS data. For this reason, investigators have to be prepared and aware of what they are looking for.Time is of the essence in this case, and it is important to decide quickly whether or not the OS data should be preserved or if the system should be shut down. Keeping a system running during data extraction can also compromise data files. This also leaves data vulnerable to malware that has been installed by a user with bad intentions, determined to undermine the operations of investigators. The types of data that can be retrieved from the OS include network connections, network configurations, running processes, open files, and login sessions.In addition, the entire contents of the memory can be retrieved from the OS history, usually with little or no alteration of data when the footprint of retrieval activity is minimized. The order in which this data is collected typically runs in a standard succession, with network connections, login sessions, and memor y collection sitting at the top of the list or priorities. These sources are more important because they tend to change over time. For example, network connections tend to time out and login sessions can change as users log in or out.Network configurations and the files that are open in a system are less time-sensitive and fall further down the list of priorities for investigators. The forensic toolkit must be diverse to ensure that data retrieval is achieved with minimal alteration (Bui, Enyeart & Luong, 2003). In addition, the message digest of each tool should be documented, along with licensing and version information, and command logs. This careful documentation protects users from sudden loss of data or other disturbances during data retrieval.In addition, a number of accessibility issues can be implemented by users, including the placement of screen saver passwords, key remapping and log disabling features, all of which can disrupt the work by investigators, either providing unworkable obstacles or time-consuming hurdles that make complete transfer impossible. Ultimately, the use of OS as a data source is a case-by-case tool dependent on the availability of other sources and the specific needs and tools of investigators. Routers and Network TrafficAmong network configuration data sources, router activity and network sourcing has the potential to provide the most specific amount of incriminating activity for forensic use. Forensic equipment should have time stamping capabilities activated to provide an accurate time signature of network interaction between an end-user and a router or switch (Schwartz, 2011). Importantly, firewalls and routers that are tied to a network often provide network address translation which can offer additional information by clarifying configuration or additional IP addresses on a network (Huston, 2004).There are a number of tools available to people seeking an analysis of network activity, including packet sniffers and intrusi on detection systems (Marcella & Menendez, 2008). These tools help investigators examine all packets for suspicious IP addresses and special events that have occurred across a network. This data is usually recorded and analyzed so that investigators can compare unusual events to evaluate network weaknesses and special interests of would-be attackers.This is of great interests to security agents determined to identify and stop potential network intrusions. A number of technical, procedural, legal and ethical issues exist when examining and analyzing network data. It is imperative that investigators be sure to avoid disconnected from a network or rebooting a system during data retrieval. They should also rely on live data and persistent information. Finally, it is important to avoid running configuration commands that could corrupt a network or its activity (Gast, 2010).Issues such as storage of large amounts of data over a highly trafficked network and proper placement of a decryptio n device along a network can impact how data is available and whether or not it maintains integrity. It is also important to consider the ethical and legal issues of data retrieval along a network when it involves sensitive data, such as financial records and personal information like passwords. In many cases, ethical issues can be circumvented with careful documentation and the publication of organizational policies and procedures that are strictly followed.However, these are all issues that must be considered in the analysis of network trafficking as a data source. Social Network Activity The sheer volume of social network activity – such as that on Facebook, Twitter, and Instragram – makes examining it as a data source great potential as a forensic tool. To this point, the little available research on social network data has failed to come up with a comprehensive framework or set of standards for investigators. Social network tools across mobile platforms invariably have geolocation services.However, the use of these as a data source has been questioned from ethical and legal perspectives (Humaid, Yousif, & Said, 2011). The communication layer of social media applications on mobile devices can yield rich data, such as a browser cache and packet activity. Packet sniffing can expose unencrypted wifi use and third party intrusion across a social network. However, these tools are highly limited when they are restricted to social network activity. The best tools may be the ability to create a social footprint, which includes all friend activity, posted pictures and videos, communication habits, and periods of activity.For most people, this information is only available on social network websites and is not stored on a user’s hard drive. A certain climate of permissibility tends to apply to social network use, in which users are prone to making data available online that they would not otherwise expose. All of this strengthens the use of soci al networks as a data source. The greatest pitfall to social network activity is the malleability of the material. Users frequently change their habits, including the times of the day and the users with whom they connect.Cumulative social network data can be used to create a graph of all activity across a variety of factors, including time, space, usage, and devices (Mulazzani, Huber, & Weippl). But this is a rapidly changing field. There is little doubt that the cloud computing data storage and continued growth of social networks will change this field quickly, which could quickly undermine past data that has been retrieved. Potential Usefulness in Specific Events The usefulness of a data source is strictly tied to the event it is intended to investigate.It is imperative that investigators are clear on their goals prior to selecting a source to retrieve and analyze data from. For example, a network intrusion would be best tackled with an examination of network traffic, followed by social network analysis, Operating Systems, and data file systems. Network analysis is less prone to attacking strategies that can compromise file and OS data. It can observe network traffic to find anomalous entities and their entry point within a network. It can also identify source and destination data by data recovery and access to routers r other network access points (Aquilina, Casey & Malin, 2008). This is critical information for network intrusion investigations. Operating Systems enable access to volatile data, but this is limited by single-time use and data integrity issues. Most OS examinations look at network connections first, which is often another way of accessing the same data. File storage and social network analysis tend to offer peripheral views of the same material. Operating systems are the most helpful data source in malware installation investigation, followed by network traffic, data files, and social network activity.Examination of volatile data offers a ran ge of data, including network connections and login sessions, which are primary tools for finding the source of malware installation (Aquilina, Casey & Malin, 2008). Maintaining the integrity of data through quick retrieval and minimal footprints helps ensure its usefulness. At the same time, monitoring network traffic in a pro-active manner is often the surest way of pinpointing time signatures and matching them with network activity (Marcella & Menendez, 2008). The best data sources for identifying insider file deletion are data files, network traffic, social network activity and OS.Each source offers benefits for this type of investigation, but data file collection and analysis yields bad clusters and slack space, both of which pinpoint the likelihood of deleted files. Recovery can begin from this point. Network activity and OS data retrieval can lead investigators to unusual login attempts and anomalous activity in order to pinpoint the location of deleted files along a network. At the same time, social network examination can help investigators understand reasons for deleted files and even learn more about the habits and lifestyle of a likely perpetrator.In the end, a collection of each of these sources provides a rich, revealing glimpse at deleted file activity. Conclusion Network traffic, data files, operating systems, and social network activity are four common data sources in digital forensic. Each provides a unique opportunity and set of risks for investigators, and the source should be chosen based on clear objectives and awareness of all circumstances. In many cases, the best choice is a combination of sources to provide multiple opportunities to arrive at the relevant evidence.Another factor is whether the data search is reactive or pro-active, with network traffic often providing the best source of evidence in a pro-active, forward-thinking environment. The variable of time must also be considered, specifically with respect to how investigators a pproach volatile data. Each of these issues must be considered when evaluating data sources. References Aquilina, J. , Casey, E. & Malin, C. (2008). Malware forensics: Investigating and Analyzing Malicious Code. Burlington, MA: Syngress Publishing. Bui, S. , Enyeart, M. & Luong, J. (2003, May). Issues in Computer Forensics. Retrieved ttp://www. cse. scu. edu/~jholliday/COEN150sp03/projects/Forensic%20Investiga tion. pdf Garfinkel, S. (2010). Digital forensics research: The next 10 years. Digital Investigation, 7. 64-73. Gast, T. (2010). Forensic data handling. The Business Forum. Retrieved from http://www. bizforum. org/whitepapers/cybertrust-1. htm Humaid, H. , Yousif, A. & Said, H. (2011, December). Smart phones forensics and social networks. IEEE Multidisciplinary Engineering Education Magazine, 6(4). 7-14. Huston, G. (2004, September). Anatomy: A look inside network address translators. The Internet Protocol Journal, 7(3).Retrieved from http://www. cisco. com/web/about/ac123/ac1 47/archived_issues/ipj_7- 3/anatomy. html Marcella, A. & Menendez, D. (2008). Cyber Forensics: A Field Manual for Collecting, Examining, and Preserving Data. Boca Raton, FL: Auerbach Publications. Mulazzani, M. , Huber, M. & Weippl, E. (n. d. ). Social network forensics: Tapping the data pool of social networks. SBA-Research. Retrieved from http://www. sba- research. org/wp-content/uploads/publications/socialForensics_preprint. pdf Purita, R. (2006). Computer Forensics: A valuable audit tool. Internal Auditor. Retrieved from http://www. theiia. rg/intAuditor/itaudit/archives/2006/september/computer- forensics-a-valuable-audit-tool-1/ Schwartz, M. (2011, December). How digital forensics detects insider theft. InformationWeek Security. Retrieved from http://www. informationweek. com/security/management/how-digital-forensics- detects-insider-t/232300409 Sindhu, K. & Meshram, B. (2012). A digital forensic tool for cyber crime data mining. Engineering Science and Technology: An Internati onal Journal, 2(1). 117-123. Sindhu, K. , Tripathi, S. & Meshram, B. (2012). Digital forensic investigation on file system and database tampering. IOSR Journal of Engineering, 2(2). 214-221. Business Continuity Plan Data Sources in Digital Forensics March 17, 2013 Joana Achiampong CSEC 650 Introduction Four sources of data that stand out for forensic investigators in most criminal investigations are files, operating systems, routers and network traffic, and social network activity. Each data source presents a variety of opportunities and challenges for investigators, meaning that the more reliable data collection and analysis activity typically involves examination of a variety of sources.Digital forensics must cover the four basic phases of activity, which include: data collection, which describes the identification and acquisition of relevant data; data examination, which includes the processing of data through the use of automated and manual tools; analysis, which describes the evaluation and categorization of examined data into coherent groups, such as their usefulness in a court proceeding; and reporting, in which the results of analysis are described with careful attention paid to recommen dations (Marcella & Menendez, 2009).The viability of each data source to an investigation must be evaluated based on how they can contribute to each phase. For example, the ability of routers and switches as a data source to help investigators might be effective in one area, but not in the other three. An examination of router activity might yield a surfeit of observable data that fails to provide diverse analytical tools that cannot be relied upon in a forensic setting. Another example is network traffic, which may yield a large amount of data that is unreliable or has a high degree of volatility (Garfinkel, 2010).Time is often essential for forensic investigators, and it is often important to know in advance the dynamics of each data source. This helps investigators avoid wasted time, or spending time analyzing data that may of minimal help in a forensic setting. For these reasons, it is important to critically assess the pros and cons of each data source for their ability to prov ide contributions. A valid assessment of each data source should be made based on consistent factors such as costs, data sensitivity, and time investment.The overall costs of each data source depend on the equipment that will be required to collect and analyze data without corruption. Costs also refer to the training and labor required during the course of the collection and analysis, which may be higher for uncommon sources that require a unique process and chain of command pattern. Data sensitivity is critical is a forensic tool, but may be more questionable depending on the source. For example, network activity can provide a wealth of information depending on the device and setting upon which data is moved.However, a network environment with many devices and multiple configurations may provide unreliable data that cannot be recognized in court proceedings. In addition, chain-of-command issues regarding the contribution of outside network analysts could compromise a source that wo uld be otherwise valid. These issues have to be considered in any data source assessment. Data Files The most common data sources in a digital forensic examination are current and deleted files. Most forensic investigators in most data retrieval environments begin with an examination of the various media store on the hard drive of a computer, network, or mobile device.The variety of types of stored data in current and deleted files, in addition to partitioned packet files and the slack space of a device’s memory, can be massive and diverse. A typical first step in data retrieval is to shut down a system and create a data grab or forensic duplicate upon which collection and analysis can be made. This ensures the integrity of the original data, while allowing investigators the ability to manipulate data however they see fit. However, this process alone creates challenges for forensic investigators, including an inability to capture live system data.This might prevent investigat ors from catching a perpetrator in the act of altering or adding data to a device or system. One of the primary benefits of files as a data source is the ability to separate and analyze the types of files, which creates a specific signature based on the content and user (Marcella & Menendez, 2008). Data can be pulled from deleted files, slack space on a system’s hard drive, or free space, all of which provides information that can be useful to investigators.The directory location and allocation type for each file informs the data that has been collected, including a time stamp and whether tools have been used to hide the data. Each of these characteristics provides investigators easy-to-access information about a system. In addition, there are a variety of hardware tools that can be used to access data. This technology is fairly common, meaning that associated costs tend to be minimal when retrieving data from files (Purita, 2006). File examination can yield a variety of type s of suspicious activity that tend to be helpful for investigators.One example is the presence of hidden evidence on file systems. This type of data can be hidden in deleted file spaces, slack spaces, and bad clusters. File space is marked as deleted when it is removed from an active directory. This data will continue to exist within a cluster of a hard disk can be identified and accessed by creating a file in Hex format and transferring the copied data. Data can also be hidden in many others ways, including by removing partitions that are created between data and by leveraging the slack space that exists between files.Attempts by users to hide data using these methods are quickly identifiable by investigators, who can then restore the data using a variety of inexpensive and efficient methods. For example, matching RAM slack to file slack identifies the size of a file and makes it easier to identify and retrieve (Sindhu & Meshram, 2012). This type of retrieval inherently emphasizes the importance of data integrity. This type of integrity is important in any forensic environment, and compromised data is usually rendered instantly unusable. The many opportunities for data retrieved from file space to be compromised are a drawback to this data source.For example, data retrieval using bit stream imaging provides a real-time copy onto a disk or similar medium. However, this can be compromised based on the fact that re-imagining of data is constantly changing during re-writing. Investigators will typically choose the type of data copy system based on what they are looking for. However, changes to data can occur if the appropriate safeguards are not taken. Write-blockers are often used to prevent an imaging process from providing data that has been compromised by writing to that media. Sindhu and Meshram 2012) stated that computing a message digest will create a verification of the copied data based on a comparison to the original. A message digest is an algorithm th at takes input data and produces an output digest. This comparison helps investigators ensure the integrity of data in many cases. There are additional pitfalls when it comes to using files as data sources. Users have different resources for eliminating or hindering data collection. One example is overwriting content by replacing it with constant values. This type of wiping function can be performed by a variety of utilities.Users can also demagnetize a hard drive to physically destroy the content stored there. Using files as a data source in this case will require a complex operation requiring different tools. Users can also purposefully misname files – for example, giving them . jpg extensions when they are not image content files – in order to confuse investigators. Investigators have to be familiar with strategies for circumventing these pitfalls, such as maintaining an up-to-date forensic toolkit and remaining committed to maintaining data integrity.In the end, fi les are very highly relied upon by investigators and are a strong source forensic data. However, investigators must be experienced and have the appropriate tools to ensure the viability of collected data. Operating Systems Generally speaking, the data that can be collected from Operating Systems (OS) is more diverse and rich than file systems data, and has greater potential to uncover application-specific events or vital volatile data specific to a network operation (Sindhu, Tribathi & Meshram, 2012).However, OS data mining can be more difficult and challenging, and often requires investigators to make quick decisions based on the type of data they are seeking. OS data mining is more case specific, in part because the retrieval of data is frequently connected to network configurations. Collecting volatile data can only occur from a live system that has not been shut down or rebooted (Marcella & Menendez, 2008). Additional activity that occurs over an individual network session is ve ry likely to compromise the OS data. For this reason, investigators have to be prepared and aware of what they are looking for.Time is of the essence in this case, and it is important to decide quickly whether or not the OS data should be preserved or if the system should be shut down. Keeping a system running during data extraction can also compromise data files. This also leaves data vulnerable to malware that has been installed by a user with bad intentions, determined to undermine the operations of investigators. The types of data that can be retrieved from the OS include network connections, network configurations, running processes, open files, and login sessions.In addition, the entire contents of the memory can be retrieved from the OS history, usually with little or no alteration of data when the footprint of retrieval activity is minimized. The order in which this data is collected typically runs in a standard succession, with network connections, login sessions, and memor y collection sitting at the top of the list or priorities. These sources are more important because they tend to change over time. For example, network connections tend to time out and login sessions can change as users log in or out.Network configurations and the files that are open in a system are less time-sensitive and fall further down the list of priorities for investigators. The forensic toolkit must be diverse to ensure that data retrieval is achieved with minimal alteration (Bui, Enyeart & Luong, 2003). In addition, the message digest of each tool should be documented, along with licensing and version information, and command logs. This careful documentation protects users from sudden loss of data or other disturbances during data retrieval.In addition, a number of accessibility issues can be implemented by users, including the placement of screen saver passwords, key remapping and log disabling features, all of which can disrupt the work by investigators, either providing unworkable obstacles or time-consuming hurdles that make complete transfer impossible. Ultimately, the use of OS as a data source is a case-by-case tool dependent on the availability of other sources and the specific needs and tools of investigators. Routers and Network TrafficAmong network configuration data sources, router activity and network sourcing has the potential to provide the most specific amount of incriminating activity for forensic use. Forensic equipment should have time stamping capabilities activated to provide an accurate time signature of network interaction between an end-user and a router or switch (Schwartz, 2011). Importantly, firewalls and routers that are tied to a network often provide network address translation which can offer additional information by clarifying configuration or additional IP addresses on a network (Huston, 2004).There are a number of tools available to people seeking an analysis of network activity, including packet sniffers and intrusi on detection systems (Marcella & Menendez, 2008). These tools help investigators examine all packets for suspicious IP addresses and special events that have occurred across a network. This data is usually recorded and analyzed so that investigators can compare unusual events to evaluate network weaknesses and special interests of would-be attackers.This is of great interests to security agents determined to identify and stop potential network intrusions. A number of technical, procedural, legal and ethical issues exist when examining and analyzing network data. It is imperative that investigators be sure to avoid disconnected from a network or rebooting a system during data retrieval. They should also rely on live data and persistent information. Finally, it is important to avoid running configuration commands that could corrupt a network or its activity (Gast, 2010).Issues such as storage of large amounts of data over a highly trafficked network and proper placement of a decryptio n device along a network can impact how data is available and whether or not it maintains integrity. It is also important to consider the ethical and legal issues of data retrieval along a network when it involves sensitive data, such as financial records and personal information like passwords. In many cases, ethical issues can be circumvented with careful documentation and the publication of organizational policies and procedures that are strictly followed.However, these are all issues that must be considered in the analysis of network trafficking as a data source. Social Network Activity The sheer volume of social network activity – such as that on Facebook, Twitter, and Instragram – makes examining it as a data source great potential as a forensic tool. To this point, the little available research on social network data has failed to come up with a comprehensive framework or set of standards for investigators. Social network tools across mobile platforms invariably have geolocation services.However, the use of these as a data source has been questioned from ethical and legal perspectives (Humaid, Yousif, & Said, 2011). The communication layer of social media applications on mobile devices can yield rich data, such as a browser cache and packet activity. Packet sniffing can expose unencrypted wifi use and third party intrusion across a social network. However, these tools are highly limited when they are restricted to social network activity. The best tools may be the ability to create a social footprint, which includes all friend activity, posted pictures and videos, communication habits, and periods of activity.For most people, this information is only available on social network websites and is not stored on a user’s hard drive. A certain climate of permissibility tends to apply to social network use, in which users are prone to making data available online that they would not otherwise expose. All of this strengthens the use of soci al networks as a data source. The greatest pitfall to social network activity is the malleability of the material. Users frequently change their habits, including the times of the day and the users with whom they connect.Cumulative social network data can be used to create a graph of all activity across a variety of factors, including time, space, usage, and devices (Mulazzani, Huber, & Weippl). But this is a rapidly changing field. There is little doubt that the cloud computing data storage and continued growth of social networks will change this field quickly, which could quickly undermine past data that has been retrieved. Potential Usefulness in Specific Events The usefulness of a data source is strictly tied to the event it is intended to investigate.It is imperative that investigators are clear on their goals prior to selecting a source to retrieve and analyze data from. For example, a network intrusion would be best tackled with an examination of network traffic, followed by social network analysis, Operating Systems, and data file systems. Network analysis is less prone to attacking strategies that can compromise file and OS data. It can observe network traffic to find anomalous entities and their entry point within a network. It can also identify source and destination data by data recovery and access to routers r other network access points (Aquilina, Casey & Malin, 2008). This is critical information for network intrusion investigations. Operating Systems enable access to volatile data, but this is limited by single-time use and data integrity issues. Most OS examinations look at network connections first, which is often another way of accessing the same data. File storage and social network analysis tend to offer peripheral views of the same material. Operating systems are the most helpful data source in malware installation investigation, followed by network traffic, data files, and social network activity.Examination of volatile data offers a ran ge of data, including network connections and login sessions, which are primary tools for finding the source of malware installation (Aquilina, Casey & Malin, 2008). Maintaining the integrity of data through quick retrieval and minimal footprints helps ensure its usefulness. At the same time, monitoring network traffic in a pro-active manner is often the surest way of pinpointing time signatures and matching them with network activity (Marcella & Menendez, 2008). The best data sources for identifying insider file deletion are data files, network traffic, social network activity and OS.Each source offers benefits for this type of investigation, but data file collection and analysis yields bad clusters and slack space, both of which pinpoint the likelihood of deleted files. Recovery can begin from this point. Network activity and OS data retrieval can lead investigators to unusual login attempts and anomalous activity in order to pinpoint the location of deleted files along a network. At the same time, social network examination can help investigators understand reasons for deleted files and even learn more about the habits and lifestyle of a likely perpetrator.In the end, a collection of each of these sources provides a rich, revealing glimpse at deleted file activity. Conclusion Network traffic, data files, operating systems, and social network activity are four common data sources in digital forensic. Each provides a unique opportunity and set of risks for investigators, and the source should be chosen based on clear objectives and awareness of all circumstances. In many cases, the best choice is a combination of sources to provide multiple opportunities to arrive at the relevant evidence.Another factor is whether the data search is reactive or pro-active, with network traffic often providing the best source of evidence in a pro-active, forward-thinking environment. The variable of time must also be considered, specifically with respect to how investigators a pproach volatile data. Each of these issues must be considered when evaluating data sources. References Aquilina, J. , Casey, E. & Malin, C. (2008). Malware forensics: Investigating and Analyzing Malicious Code. Burlington, MA: Syngress Publishing. Bui, S. , Enyeart, M. & Luong, J. (2003, May). Issues in Computer Forensics. Retrieved ttp://www. cse. scu. edu/~jholliday/COEN150sp03/projects/Forensic%20Investiga tion. pdf Garfinkel, S. (2010). Digital forensics research: The next 10 years. Digital Investigation, 7. 64-73. Gast, T. (2010). Forensic data handling. The Business Forum. Retrieved from http://www. bizforum. org/whitepapers/cybertrust-1. htm Humaid, H. , Yousif, A. & Said, H. (2011, December). Smart phones forensics and social networks. IEEE Multidisciplinary Engineering Education Magazine, 6(4). 7-14. Huston, G. (2004, September). Anatomy: A look inside network address translators. The Internet Protocol Journal, 7(3).Retrieved from http://www. cisco. com/web/about/ac123/ac1 47/archived_issues/ipj_7- 3/anatomy. html Marcella, A. & Menendez, D. (2008). Cyber Forensics: A Field Manual for Collecting, Examining, and Preserving Data. Boca Raton, FL: Auerbach Publications. Mulazzani, M. , Huber, M. & Weippl, E. (n. d. ). Social network forensics: Tapping the data pool of social networks. SBA-Research. Retrieved from http://www. sba- research. org/wp-content/uploads/publications/socialForensics_preprint. pdf Purita, R. (2006). Computer Forensics: A valuable audit tool. Internal Auditor. Retrieved from http://www. theiia. rg/intAuditor/itaudit/archives/2006/september/computer- forensics-a-valuable-audit-tool-1/ Schwartz, M. (2011, December). How digital forensics detects insider theft. InformationWeek Security. Retrieved from http://www. informationweek. com/security/management/how-digital-forensics- detects-insider-t/232300409 Sindhu, K. & Meshram, B. (2012). A digital forensic tool for cyber crime data mining. Engineering Science and Technology: An Internati onal Journal, 2(1). 117-123. Sindhu, K. , Tripathi, S. & Meshram, B. (2012). Digital forensic investigation on file system and database tampering. IOSR Journal of Engineering, 2(2). 214-221.