Chapter 1: Computer Forensics Fundamentals

---

OVERVIEW

Electronic evidence and information gathering have become central issues in an increasing number of conflicts and crimes. Electronic or computer evidence used to mean the regular print-out from a computer—and a great deal of computer exhibits in court are just that. But, for many years, law enforcement officers have been seizing data media; and, computers themselves, as they have become smaller and more ubiquitous.

In the very recent past, investigators generated their own print-outs, sometimes using the original application program, sometimes specialist analytic and examination tools. More recently, investigators have found ways of collecting evidence from remote computers to which they do not have immediate physical access, provided such computers are accessible via a phone line or network connection. It is even possible to track activities across a computer network, including the Internet.

These procedures form part of what is called computer forensics, though some people also use the term to include the use of computers to analyze complex data (for example, connections between individuals by examination of telephone logs and/or bank account transactions). Another use of the term is when computers are employed in the court itself, in the form of computer graphics, to illustrate a complex situation such as a fraud or as a replacement for large volumes of paper-based exhibits and statements.

So, what actually is computer forensics? Computer forensics is about evidence from computers that is sufficiently reliable to stand up in court and be convincing. You might employ a computer forensics specialist to acquire evidence from computers on your behalf. On the other hand, you may want one to criticize the work of others. The field is a rapidly growing one, with a solid core, but with many controversies at its edges.

---