Forensics Q&A

What is Computer Forensics?

There a number of slightly varying definitions around. However, generally, computer forensics is considered to be the use of analytical and investigative techniques to identify, collect, examine and preserve evidence/information which is magnetically stored or encoded.

What is the objective of this?

Usually to provide digital evidence of a specific or general activity.

To what ends?

A forensic investigation can be initiated for a variety of reasons. The most high profile are usually with respect to criminal investigation, or civil litigation, but forensic techniques can be of value in a wide variety of situations, including perhaps, simply re-tracking steps taken when data has been lost.

What are the common scenarios?

Wide and varied! Examples include:

- Employee Internet abuse

- Unauthorized disclosure of corporate information and data (accidental and intentional)

- Industrial espionage

- Damage assessment (following an incident)

- Criminal fraud and deception cases

- More general criminal cases (many criminals simply store information on computers, intentionally or unwittingly)and countless others!

How is a computer forensic investigation approached?

It's a detailed science. However, very broadly, the main phases are:

- Acquire and preserve the evidence

- Analyze the evidence

- Present computer evidence by creating a case report to document the evidence and investigation results.

For more information about computer forensics or for rate information, please contact us at 518-437-1600.