How Do You Solve A Computer Forensic Case?
Computer forensics is the section of forensic science that deals with obtaining legal evidence that can be found in computers and digital media. In a computer forensic case, computer systems and their storage media are analyzed so that evidence can be gathered to support legal theories regarding the defendant or litigant. This is a highly specialized branch of science that requires the individual to follow appropriate regulations regarding the chain of custody related to evidence. Prepare for the forensic examination. Talk to key people to find out what you are looking for and what the circumstances surrounding the case are. When you have a foundation in the case, start assembling your tools to collect the data in question. Collect the data from the target media. You will be creating an exact duplicate image of the device in question. To do this, you will need to use an imaging software application like the commercial EnCase or the open source SleuthKit/Autopsy (see Resources section).
