Computer Forensics
Computer Forensics
In the early 1980s personal computers began to be more accessible to consumers and,
subsequently, began to be used for criminal activity (for example, to help commit fraud). At the
same time, several new "computer crimes" were recognized (such as hacking). The discipline of
computer forensics emerged during this time as a method to recover and investigate digital
evidence for use in court. Today it is used to investigate a wide variety of crime, including child
pornography, fraud, cyberstalking, murder and rape. The discipline also features in civil
proceedings as a form of information gathering (for example, Electronic discovery
Although it is most often associated with the investigation of a wide variety of computer crime,
computer forensics may also be used in civil proceedings. The discipline involves similar
techniques and principles to data recovery, but with additional guidelines and practices designed
to create a legal audit trail.
Evidence from computer forensics investigations is usually subjected to the same guidelines and
practices of other digital evidence. It has been used in a number of high profile cases and is
becoming widely accepted as reliable within US and European court systems
Forensic techniques and expert knowledge are used to explain the current state of a digital
artifact; such as a computer system, storage medium (e.g. hard disk or CD-ROM), an electronic
document (e.g. an email message or JPEG image).[2] The scope of a forensic analysis can vary
from simple information retrieval to reconstructing a series of events. In a 2002 book Computer
Forensics authors Kruse and Heiser define computer forensics as involving "the preservation,
identification, extraction, documentation and interpretation of computer data".[3] They go on to
describe the discipline as "more of an art than a science", indicating that forensic methodology is
backed by flexibility and extensive domain knowledge.
NIKHIL JAIN