Short Paper: Computer Forensics Overview

Computer Forensics: When looking at the bigger picture of the computer forensics investigation there are three main areas of action that must take place for a successful investigation. The three main actions are to acquire and preserve the data, analyzing the data and then preparing a report.

The first step is to forensically acquire and preserve the electronic evidence. This requires many specialized tools in or to practice sound forensic techniques. Although these tools are often cost prohibitive to many individuals and or companies, without them the forensic investigation would be compromised and would never hold up in a court of law. For the digital evidence be valid, it must be preserved in its original form. There are two different ways to do this. It can be done by creating a mirror image with software application or utilizing hardware devices. Software acquisitions create a forensically sound image that makes no changes to the information on the subject hard drive. As where hardware acquisition tools duplicate drives or allow read only access to the subject drive. The forensic image must be identical to the original no changes should be made to the evidence.

The next step in the forensic process is to analyze the preserved electronic image. During the analysis phase of the computer forensic investigation there are many steps. The steps taken are usually dependent on what the investigator is looking for. The analysis of the acquired data is the most time consuming part of a Computer Forensic investigation.

Following the analysis of the electronic data the investigator must be able to present the findings in manner that allows the public to understand the findings. If the case in question has to be taken into a court of law the attorney presenting the information must be able to relay it to the audience. This is a critical part of the process. If the information cannot be digested then it is of no use to the user. Many of the high end computer forensic software with help the investigator prepare the report in the proper format.

The above illustrates only some of the main points that must be performed in a properly conducted computer forensic investigation. Without the specialized tools and procedure not many investigations companies are properly set up to perform computer forensics investigations.