Computer Forensics

What is Computer Forensics?

Computer forensics consists of techniques that include analysis and investigation of evidence. Someone that is involved in computer forensics gathers evidence from some type of device and preserves it to be presented in a court. The main goal of this type of forensics is to structure investigation to maintain the integrity of evidence and document it properly. They are trying to determine what happened to the device and who created the problem. There is a set procedure to create standards for handling the evidence. The investigator makes a digital copy of whatever they are studying and does all the work on the copy to determine what the breach is and if it was a breach at all.


A whole host of techniques may be used to dig into the copy to find out what happened to it. They search for hidden files and other items. They look for damaged, deleted, or locked files. The forensics investigator must create a detailed report to prepare for discovery and court proceedings. This has become an area that requires a specific type of knowledge and experience.


Corporate Investigations are when there are investigations into a business or corporations to determine when there was inappropriate actions by an employee, management, or someone outside of the organization. Corporate Investigations can be changeable based on the needs of the organization. This could be to study a business partner to determine if all their actions are legitimate for the business. There could be fraud, theft, or some other cyber crime against the company.