What Is Computer Forensics?
Computers are a very large part of most people’s daily lives. In fact, the number of homes that have a personal computer has grown exponentially in the past five to ten years. Consequently, computer crime, specifically identity theft and other computer-generated financial crimes, has grown in number and has become an increasingly serious issue. Many municipal police departments have a computer forensics team. However, in years to come they will become even more widespread. Computer forensics uses special techniques and skills to recover, authenticate, and analyze electronic information and data. It is specifically helpful for police officers and investigators who are attempting to solve a crime where a computer has been used. A specialist in the field of computer forensics usually has broad working knowledge and specific software that works on the devices that store data. This can include hard drives and other computer media. The computer forensics specialist can determine sources of d
Computer forensics, sometimes known as Digital Forensics, is often described as “the preservation, recovery and analysis of information stored on computers or electronic media”. It often embraces issues surrounding Digital Evidence with a significant legal perspective, and is sometimes viewed as a Four Step Process.
Computer forensics is the collection, preservation, analysis, and presentation of computer-related evidence. Computer evidence can be useful in criminal cases, civil disputes, and human resources/employment proceedings. Far more information is retained on a computer than most people realize. It’s also more difficult to completely remove information than is generally thought. For these reasons (and many more), computer forensics can often find evidence of, or even completely recover, lost or deleted information, even if it was intentionally deleted.
There a number of slightly varying definitions around. However, generally, computer forensics is considered to be the use of analytical and investigative techniques to identify, collect, examine and preserve evidence/information which is magnetically stored or encoded. 2. What is the objective of this? Usually to provide digital evidence of a specific or general activity. 3. To what ends? A forensic investigation can be initiated for a variety of reasons. The most high profile are usually with respect to criminal investigation, or civil litigation, but digital forensic techniques can be of value in a wide variety of situations, including perhaps, simply re-tracking steps taken when data has been lost. 4. What are the common scenarios? Wide and varied! Examples include: – Employee internet abuse (common, but decreasing) – Unauthorized disclosure of corporate information and data (accidental and intentional) – Industrial espionage – Damage assessment (following an incident) – Criminal fr
