Privacy, Encryption and Security

Computer Forensics Resources

The crimes of today are more sophisticated than many of the crimes that were committed in the past. Today, criminals have the added help of modern technology to break the law. Often, this involves using computers to commit both small and large scale crimes against individuals, businesses, and even governments. Computer hackers may use computers to steal money from bank accounts or commit identity theft, while stalkers may gather information about a victim from online sources and drug dealers can store client and inventory data in encrypted computer files. Advanced criminals may even break into official computers for access to confidential information or to spread viruses. Additionally, computers are now instrumental in non-criminal activities that are subject to lawsuits. For example, dishonest spouses may also use computers to facilitate extramarital affairs, improperly hide money, or commit other forms of torts that can only be remedied by lawsuits. In order for the law to keep up with illegal activities, both law enforcement and civil litigants alike must rely on the skills of computer forensics experts.

What Is Computer Forensics and How Does it Work?
Computer forensics is a part of the overall world of forensics science, particularly digital forensics. While forensics involves the general use of science to gather information about someone's activities, computer forensics involves the use of computer science to discover facts concerning activities on computers. Because of this, a computer forensics investigation begins with the acquisition of all digital artifacts, or computing devices owned or used by the person of interest. Forensics experts are especially interested in devices that use data storage media, which is often where they will find most of the relevant information available for use in civil or criminal investigations.

The goal of acquiring data from computers is to accurately recreate the actions of the person of interest in sequence, which may then be presented to jurors in a court of law. To do this the forensics analyst will need to extract and preserve all data from the storage media in question. The information gathered must be trustworthy and unadulterated, so that it is admissible in a court of law. This means that the data retrieved cannot be altered in any way during the extraction process or while being stored at any point during the investigation. Then the forensics expert must analyze the data and determine what information is relevant to the case. Finally, they will need to report on what they have found and testify about their findings in court.

Computer Forensics Training
While computer forensics is a relatively new branch of general forensics science, in many cases formal training is a prerequisite to gaining employment in the field. One traditional path to becoming a forensics expert is by going to college or a vocational school for an associate's or bachelor's degree in computer forensics science. Another way is to acquire a certification as a computer forensics expert. In most cases once hired one will require further training to catch up with the latest computer forensics challenges and investigation techniques. To maximize one's chances of obtaining a job in the industry, both a bachelor's degree and certification are recommended.