Computer Forensics

Computer forensics can be defined as a branch of digital forensic science pertaining to legal evidence found in computers and digital storage media. The general goal of computer forensics is to examine digital media with the aim of identifying, preserving, recovering, analyzing, and presenting facts and opinions about the information. Computer forensics helps determine the who, what, where, and when related to a computer-based crime or violation. In the field, crucial data can be gathered from dozens of sources. The sources include; computer messaging, emails, the Internet, tapes, cds, disks, or printouts made by a specific computer. Evidence can be sought in a wide range of computer incidents including: theft of company secrets, terrorism, credit card fraud, financial crimes, embezzlement, economic crimes, harassment, child pornography, and identity theft. Computer forensics can be used to investigate any crime directly or indirectly related to a computer.
       Computer forensics combines specialized techniques with the use of sophisticated software to view and analyze information that cannot be accessed by the ordinary user. Even if the information has been ‘deleted’ by the user months or even years prior to the investigation, the information may still exist in whole or part or part of the computer hard drive. When an investigation begins, it is essential for the forensics specialist to confirm whether or not the computer in question contains information relevant to the matter, assist in preparing interrogatories, and retrieving and examining information that is accessible only through the use of forensics programs and methods. In order to determine whether a computer holds information that may serve as evidence, the professional must create exact image of the drive. The examiner examines only this image drive to protect the original from alterations. These images must be bit-by-bit or “mirror” images of the originals.

http://newyorkcomputerforensics.com/learn/index.php