Computer Forensics

          Forensics in general is the process of using scientific knowledge in order to collect and/or analyze evidence to courts. Computer forensics is not yet recognized as a scientific discipline but it is defined as the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is acceptable as evidence in a court of law.  The point of computer forensics is to observe digital media in a forensic environment with the goal of presenting facts about some sort of information.


         Computer forensics is important because when it comes to handling an organization it can save you money.  Many managers find it important to invest their money in buying computers and network security.  Some typical aspects of a computer forensic investigation is that the person who is investigating must understand the potential evidence they are looking for in order to develop criteria for the search.  Crimes that involve a computer can range from criminal activity like child pornography to the theft of personal data.  The investigator must also pick the appropriate tools to use.  Files that might have been deleted or damaged, the investigator must be familiar with methods and software to prevent further damage in the recovery process.     

Sources:

Computer Forensics World

Computer Forensics PDF