Discussing the Art of Computer Forensics

We all know that we live in a technology-driven, technology-saturated culture. Computers, cell phones, iPods, PDAs, game systems…you name it…are all over the place. And information is passed constantly throughout the different technological mediums. That information, fortunately for some and unfortunately for others, is saved; and it can always be retrieved through certain procedures. These procedures and tactics are what is known as computer (or digital) forensics. As private investigators, it is our job to known how this skill set well. So in this article we will discuss the art of computer forensics and all that it entails.

Computer Forensics` Goal
The goal of any computer forensics is the retrieval of information – no matter if it is lost or simply hidden. The information, also known as a digital artefact, could be on a computer, a hard drive, a USB card, a cell phone, or throughout many computers on a network. Any storage medium can be searched. The information is retrieved for various reasons.

Reasons for Retrieval
Attorneys and Prosecutors often employ computer forensics to analyze a person`s or a business` computers, searching for evidence for or against the client. In the event of a loss of information, as happens, for example, in the case of a hard drive crash, then it will be used to retrieve what is lost. Computer forensics can also be used to trace how a hacker broke in to a network or computer. And finally, employers can use computer forensics to gain valuable evidence against an employee accused of illegal or fraudulent activities. Emails, messages and files can be traced and examined that could support or deny any claim.

The Process and Practices
There are 5 basic steps and 4 basic practices to going about computer forensics. These must be followed and adhered to in order for the retrieved information to be considered valid and permissible in a court of law. First, as for the process, an investigator will prepare, collect, examine, analyze and report. These are the 5 steps to computer forensics. In preparation, the investigator understands and strategizes for what they must find. Then, after collecting the data, they must categorize and present the information in a clear and cogent system

As for the practices, there are, again, 4. First, when doing good computer forensics, the investigator must handle the data as little as possible, preventing him from altering or tampering with the data in any way. Then, he must make certain that he established what is known as the `chain of custody`. This means that the data is clearly linked to the person or to the business under examination. In a court of law, this link-chain is vital. Thirdly, the private investigator must officially document everything observed and retrieved. And finally, it is wise to use only methods and procedures that have been tested and confirmed as valid and affective. This way, the results will be accepted as reliable and accurate.