However, this information can prove critical in solving a legal matter or a crime, and computer forensics often plays a role in identifying and preserving that information.ĭigital evidence isn't just useful in solving digital-world crimes, such as data theft, network breaches and illicit online transactions. For instance, the computers in cars continually collect information on when a driver brakes, shifts and changes speed without the driver being aware. The average person never sees much of the information modern devices collect. As computers and other data-collecting devices are used more frequently in every aspect of life, digital evidence - and the forensic process used to collect, preserve and investigate it - has become more important in solving crimes and other legal issues. In the civil and criminal justice system, computer forensics helps ensure the integrity of digital evidence presented in court cases. The forensic process is also used as part of data recovery processes to gather data from a crashed server, failed drive, reformatted operating system (OS) or other situation where a system has unexpectedly stopped working. The use of computer forensics isn't always tied to a crime. Investigators then analyze the data or system to determine if it was changed, how it was changed and who made the changes. The terms digital forensics and cyber forensics are often used as synonyms for computer forensics.ĭigital forensics starts with the collection of information in a way that maintains its integrity. The goal of computer forensics is to perform a structured investigation and maintain a documented chain of evidence to find out exactly what happened on a computing device and who was responsible for it.Ĭomputer forensics - which is sometimes referred to as computer forensic science - essentially is data recovery with legal compliance guidelines to make the information admissible in legal proceedings. Ben Lutkevich, Technical Features WriterĬomputer forensics is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law.

Network analysis definition in science