What does a computer forensic expert do?
The first rule of computer forensics will be adhered to, which simply means ” don’t alter the original evidence in any way.”A trained examiner will document all work, write-protect all media, make exact forensic copies of the media often referred to as a mirror image , perform an examination and analysis on the copy, and prepare an expert written report. Copies are typically made for the client/attorney and also for the opposing side which may also be analyzed by an opposing computer forensics expert.
