< Day Day Up > 


If there is a computer on the premises of a crime scene, the chances are very good that there is valuable evidence on that computer. If the computer and its contents are examined (even if very briefly) by anyone other than a trained and experienced computer forensics specialist, the usefulness and credibility of that evidence will be tainted.

Choosing a Computer Forensics Specialist for a Criminal Case

When you require the services of a computer forensics specialist, don’t be afraid to shop around. There are an increasing number of people who claim to be experts in the field. Look very carefully at the level of experience of the individuals involved. There is far more to proper computer forensic analysis than the ability to retrieve data, especially when a criminal case is involved. Think about computer forensics just as you would any other forensic science and look for a corresponding level of expertise.

The bottom line is that you will be retaining the services of an individual who will likely be called to testify in court to explain what he or she did to the computer and its data. The court will want to hear that individual’s own level of training and experience, not the experience of their employer. Make sure you find someone who not only has the expertise and experience, but also the ability to stand up to the scrutiny and pressure of cross-examination.

 < Day Day Up > 

 < Day Day Up > 


Computer forensics analysis is becoming increasingly useful to businesses. Computers can contain evidence in many types of human resources proceedings, including sexual harassment suits, allegations of discrimination, wrongful termination claims, and others. Evidence can be found in electronic mail systems, on network servers, and on individual employee’s computers. However, due to the ease with which computer data can be manipulated, if the search and analysis is not performed by a trained computer forensics specialist, it could likely be thrown out of court.

Employer Safeguard Program

As computers become more prevalent in businesses, employers must safeguard critical business information. An unfortunate concern today is the possibility that data could be damaged, destroyed, or misappropriated by a discontented individual.

Before an individual is informed of their termination, a computer forensic specialist should come on-site and create an exact duplicate of the data on the individual’s computer. In this way, should the employee choose to do anything to that data before leaving, the employer is protected. Damaged or deleted data can be replaced, and evidence can be recovered to show what occurred. This method can also be used to bolster an employer’s case showing the removal of proprietary information, or to protect the employer from false charges made by the employee.

Whether you are looking for evidence in a criminal prosecution, in a civil suit, or determining exactly what an employee has been up to, you should be equipped to find and interpret the clues that have been left behind. This includes situations where files have been deleted, disks have been reformatted, or other steps have been taken to conceal or destroy the evidence. For example, did you know:

  • What Web sites have been visited?

  • What files have been downloaded?

  • When files were last accessed?

  • Of attempts to conceal or destroy evidence?

  • Of attempts to fabricate evidence?

  • That the electronic copy of a document can contain text that was removed from the final printed version?

  • That some fax machines can contain exact duplicates of the last several hundred pages received?

  • That faxes sent or received via computer may remain on the computer indefinitely?

  • That e-mail is rapidly becoming the communications medium of choice for businesses?

  • That people tend to write things in e-mail that they would never consider writing in a memorandum or letter?

  • That e-mail has been used successfully in criminal cases as well as in civil litigation?

  • That e-mail is often backed up on tapes that are generally kept for months or years?

  • That many people keep their financial records, including investments, on computers?[i]

[i]“Computer Forensics,” Rehman Technology Services, Inc., 18950 U.S. Highway 441, Suite 201, Mount Dora, Florida 32757, 2001. (©Copyright 2002, Rehman Technology Services, Inc. All rights reserved), 2001.

 < Day Day Up >