What is Computer Forensics?

By: beyli

What is Computer Forensics?

Computer forensics, sometimes known as "Digital Forensics" or "Electronic Evidence Discovery", is often described as "the preservation, recovery and analysis of information stored on computers or other electronic media".

Computer forensics has quickly become a vital tool and source of information for criminal investigators, corporate counsel, and prosecutors. Computer forensics investigators use their skills to identify and restore formatted, corrupted, deleted or hidden files from computers or other electronic media while maintaining crucial data trails, time & date stamps and accurate chain of custody & controls. They also obtain access to protected or encrypted data by using specialized software.

In addition, with the increased usage and dependence on the Internet, for corporate and individual communication, computer forensic investigators are equip to analyze emails, Internet searches, file transfers, online account transactions and anything else a computer is used to do over the Internet.

How do they do it?

Computer forensic investigators typically focus on 4 areas when investigating a potential incident. There are other areas of attention as well, but the following are the most common. Including illicit and damaging activities that could damage your company's reputation.

Saved Files

These are files that can be viewed on the computer. This is usually a non-intrusive task to obtain these files.

Deleted Files

These files are just that...deleted. They are either in the 'trash' or require special software to 'capture and restore' the files. This is usually a non-intrusive task to obtain these files.

Temporary Files

These files are typically generated from browsing the Internet, working on a document, some types of back-up software as well as certain software installations for example. Identifying these requires specialized software and is an intrusive process.

Meta Data

This information typically is associated with the details of a file or document. Such as, the date the file was created, modified and last accessed. Additional information that could be captured could include the original creator of the file (of course that information depends on the original installation of the application) as well as anyone who has ever accessed the file. Identifying these requires specialized software and may or may not be an intrusive process.

What would Computer Forensics Service be used for?

There are several possible uses for this type of service. The most common applications of computer forensics are as follows:

* Divorce Cases
* Electronic Investigation
* Expert Witness Service
* Corporate E-mail Investigation
* Litigation Support
* Intellectual Property Disputes
* Investigation and Discovery Litigation Programs
* Insurance Fraud Cases
* Corporate Investigations
* Corporate Counsel Support
* Electronic Records Management

There are many reasons why you, or your company, may require the service of a computer forensics investigator. If you suspect that you may have an incident requiring computer forensic service, or electronic evidence discovery & analysis, you should secure the computer from further use and contact an experienced computer forensics service company.

Article Directory: http://www.articletrunk.com

| More

For more information about Expert Witnesses career and forensic accounting schools, visit Expert Witness

Please Rate this Article


Not yet Rated

Click the XML Icon Above to Receive Accounting Articles Articles Via RSS!

Powered by Article Dashboard