What is Computer Forensics?

Computer forensics is the use of analytical techniques to identify, preserve, collect, and examine evidence/information which is stored or recorded.

What are common situations in which computer forensics are used?

  • Unauthorized disclosure of corporate data (by accident or design)
  • Employee internet abuse
  • Damage assessment and analysis
  • Industrial espionage
  • Criminal fraud and deception cases
  • Divorce
  • More general criminal cases (many criminals simply do store information of various types on computers)

How is a computer forensic investigation approached?

  • secure the subject system (from tampering or unauthorized changes during the investigation)
  • take a copy of hard drive/disk (if applicable and appropriate)
  • identify and recover all files (including deleted files)
  • access/view/copy hidden, protected and temp files
  • study “special” areas on the drive (for example, slack space from deleted files)
  • investigate the settings and data from applications used on the system
  • consider the system as a whole from various persepctives, including its structure and overall contents
  • create detailed report containing an assessment of the data and information collected

Whether you’re dealing with a corporate data breach, wrongful termination of an employee, or a divorce/custody case against your spouse, Computer Forensics might help your case.

Contact us for information.