Computer forensics can be accurately defined as the application of investigative analysis techniques on computers and digital storage media in order to retrieve and preserve digital evidence in a way that is legally admissible. But to truly define computer forensics, you must also discuss its goals, various uses, and the stages of a digital forensics examination.
Understanding the Goals of Computer Forensics
Computer forensics has 3 main goals:
- To examine digital media in a forensically sound manner (which includes maintaining a properly documented chain of custody)
- To identify, preserve, recover, analyze, and present facts and opinions about the digital information
- To discover either what happened or who was responsible for what happened
These goals require computer forensic examiners to not only be skilled at discovering, retrieving, and preserving digital evidence, they must also be able to present the findings in a way that is understandable and defensible in court. A computer forensics expert witness can explain technical concepts in laymen’s terms, presenting the evidence they have gathered to a jury in a clear, comprehensible manner.
How is Computer Forensics Used?
In today’s technology-saturated world, there is hardly any case that doesn’t involve digital evidence of some kind. Digital device investigations can be used to prove a person’s whereabouts when a crime occured; social media investigations can uncover evidence of harassment or conspiracy; deleted data recovery can retrieve evidence after attempts to destroy it; and the list goes on. Computer forensics have been used in cases involving:
- Intellectual Property theft
- Employee theft or misconduct
- Industrial espionage
- Fraud investigations
- Bankruptcy investigations
- And more
What Defines a Computer Forensics Examination
The computer forensics examination process involves three stages: collection, processing, and review. During collection, the forensic examiner identifies, collects, analyzes, culls, and retrieves all potentially relevant data. Depending on the case, collection may involve a full forensic image of the device or a specific, targeted collection, and may be performed on-site or remotely. A certified examiner can also have success recovering deleted data or digital information from a damaged hard drive.
Once the data has been collected, it is processed in order to determine the strength of the evidence and its impact on the case. Overwhelming jurors with an excess of information is a case strategy that often backfires. It is better to hone your presentation to only your strongest and most persuasive evidence.
The last stage is review, which is often the most expensive and time-consuming phase of litigation. But with Precise’s industry-best review platform options, large volumes of ESI are processed quickly and efficiently, greatly reducing time and costs.
To learn more about digital forensics and how Precise’s experts can benefit your next case, call us today at 866-277-3247.