Computer forensics is the process of preserving, identifying, extracting and documenting valuable electronic data. The term was first used in 1991 in a training session of the International Association of Computer Specialists (IACIS). Computer forensics has been used in law enforcement and military applications for a long time now, to gather evidence from electronic sources. Today, it is being increasingly used even in the corporate sector. The increasing volumes of electronic data being created, stored and transferred each day is the main reason for this.
Every second, thousands of pages of electronic data are being transferred across the world. In the process, the data could be lost or altered. Computer forensics involves the retrieval of this lost data using special software tools and techniques. It is used to identify valuable data from personal computers or other electronic data storage devices. It is also used to identify the leakage of sensitive data from the computer, or any inherent weaknesses in the system.
When documents are created electronically, they are stored in temporary files. Even when they are deleted or updated, some remnants still remain on the hard disk and can be recovered using special tools.
Computer forensics involves the creation of a backup of all the data in the computer. This data is a mirror image of the entire hard disk, and contains even temporary, deleted or altered files. The forensic expert creates a digital fingerprint of the original hard drive to ensure that it is not tampered with while retrieving data. Data is retrieved from the mirror file rather than the original file, so as to not alter date stamps or other useful data. The retrieval process also reveals historical information about the file, such as when it was deleted or altered. The retrieved information can be converted into any required format. There are thus three stages in data recovery: acquire, analyze and report.
There are many companies that provide computer forensic services. There are also many software tools with several useful options such as cloning and disk imaging, file preview, picture gallery, etc. that enable faster and more accurate forensic recoveries.
Related Articles of Interest :
-
Disk Recovery Software
10 August 2010 8:30 PM |
No Comments
Disk recovery is the process of retrieving deleted or lost files. Files that are deleted using the ‘shift-delete’ function bypass the recycle bin and are erased from the operating system’s memory. Files may also be lost due to power blackouts, computer viruses, and through unwanted,...
-
Electronic Data Discovery Guidelines
10 August 2010 8:30 PM |
No Comments
Electronic discovery is the retrieval of data in the electronic format. These days, information is being increasingly created, stored and transferred in the electronic form. Computers, hard disks, CDs, DVDs, floppy disks and tapes are some of the most commonly used storage devices. Data can...
-
Electronic Data Discovery
10 August 2010 8:30 PM |
No Comments
In the electronic age, huge amounts of data are being generated and stored electronically. Everyday, millions of electronic data pages are being created, transferred and stored in multiple locations. Most of this data is very valuable and critical, especially for businesses. Sifting through vast quantities...
-
Electronic Document Discovery
10 August 2010 8:30 PM |
No Comments
Documents are rarely in the physical form these days. Most documents are being created in the electronic format, and even physical documents are being converted into electronic formats. Several devices, such as CD/DVD ROMs, floppy disks, hard drives and tapes, are being commonly used to...
-
Computer Forensics
10 August 2010 8:30 PM |
No Comments
Computer forensics is the process of investigating computer systems by collecting and analyzing computer-related evidence and data to determine their illegal or unauthorized involvement in crimes or frauds. This relatively new field is used by law enforcement, military, intelligence agencies, and businesses. Computer evidence processing...
-
Hard Drive Data Recovery
10 August 2010 8:30 PM |
No Comments
Hard drive data recovery is one of the most common types of data recoveries. Hard drives are mechanical active devices hence they can easily and rapidly breakdown. Hard drives are dynamic storage devices that mean that these devices are constantly upgraded and energized to save...
-
Computer Backup Software
10 August 2010 8:30 PM |
No Comments
Backup is very important while storing files on a computer or any other electronic device such as a digital camera. Computers are often notorious for crashing, which causes all the data on the hard disk to be erased. Files can also be deleted accidentally. Retrieving...
-
Computer Forensics Training
10 August 2010 8:30 PM |
No Comments
Computer forensics is the investigation and analysis of a crime using a computer to help solve the case. Computer forensics is used to investigate crimes with high tech programs. Computer forensics can also be used to prepare digital data suitable for inclusion in a criminal...
-
Computer Forensics Consulting
10 August 2010 8:30 PM |
No Comments
Computer forensics consulting is an emerging and fast-growing field in which consulting services are offered to governmental agencies, military, corporations, small companies, and businesses. Computer forensic specialists offer their services in an independent capacity. This means they are not on the regular staff of any...
-
Data Recovery Experts
10 August 2010 8:30 PM |
No Comments
Data recovery experts are basically experts involved in the process of data recovery. They are software professionals who are well acquainted with cases of data loss and they master all the software tools that are required to recover data from its affected sources. They are...