The widespread use of computers is a blessing as well as a curse for society. It is good because we can save time and energy in creating valuable products and services. On the other hand, the dark side of society uses them for sinister and selfish purposes. Forensic computing portrays this battle between good and evil, all too well.
The field of forensic computing has seen a steady rise because more and more people are using computers to commit crimes. Forensic computing refers to the practice of finding and analyzing information contained on computers and other digital media. Legal professionals use forensics to gather evidence to prove crimes such as identity theft, phishing, or commercial sabotage.
The legal profession makes frequent use of forensic computing. Some experts estimate that forensic investigations find between thirty and forty percent of documents on suspect computers. Lawyers use this evidence to help prosecute the bad guys. If you think someone uses your computer, or another one, to commit a crime, you need to preserve the system integrity.
The crime can be as simple as an employee wiping out his computer before leaving on his last day, or as complex as embezzling money from the company and trying to hide evidence. Once you become suspicious, do not use the computer more than necessary until you or someone in authority contacts a forensic expert.
Finding and recovering evidence is the first step in forensic computing. Investigators look for anything that may prove useful for law enforcement. In someways, this process is similar to the techniques used in data recovery.
The biggest difference is the culprit may have deleted the evidence on purpose rather than accidentally. Also, sophisticated criminals may have a working knowledge of computers and how the system stores information on them. This means they will try to delete information in a way that could stump the experts.