What is computer data forensics?
A computer forensic investigation is a thorough analysis of all the information stored within a computer or any attached storage device to determine any user activity and establish the identity of the user or users. Any document created or any activity undertaken by a computer user, will leave a trail of evidence that can be invaluable in any data forensic investigation. A forensic expert can piece together all the collected information to reveal a computer users conduct, sometimes even years after the events took place. For example, a data forensic investigator can establish things like who logged on to a single computer or network of computers and when; what documents were opened, read or changed; when which documents were seen by whom; which documents contain certain words or phrases; what documents have been copied, printed or emailed out; when what websites or other external computers have been visited; what data has been downloaded, removed, deleted or sabotaged; what storage dev
