What types of “evidence” can Computer Forensics provide?
In order to efficiently process data, modern computers store large amounts of data to a network or system of hard disks. Much of this information is stored without the user being aware of its existence. This data may be in the form of actual files or information that the computer used to carry out a specific task. A few examples are user files, system files, deleted files, and system data that allow the computer to perform its tasks. Accessing the information provided by the computer is often the difference between ” guessing” what happened, and ” knowing” what happened with a high degree of certainty.
