Such information is collected using packet sniffers which are programs that can access all information passing through a computer, and not only information particularly sent to the computer. The packet sniffer can either pick all the information, or just selected what is needed, and at the specific time when the information passed through the computer. This is then copied into a given memory. However, for the packet sniffers to be used, the investigators must have proper authorization depending on what they are investigation. This is to help protect the privacy of computer users. Computer forensics also works by disk imaging. This is a process where all information on a disk is copied in the form of an image and looked into. Disk imaging copies all files, both active and inactive, unlike when creating a backup where one only copies active files. One advantage of disk imaging is that it provides an extra source of information in the chance that the original disk is deleted...

This is because when analyzing the original data, anything is bound to happen.
Wiretapping is also used in not so complicated cases. Wiretapping can simply be done by hooking a recorder to telephone lines. In a much advanced situation, bugs are hooked to telephone lines. Bugs are devices that receive audio information and send it to a set destination via radio waves. The bug is hooked to the circuit of the telephone and therefore turns itself on and off depending on how the phone is being used.

The information collected in any of the above ways is then used to carry out investigations, and even presented in courts as evidence. It is however unfortunate that Computer forensics is rarely used when investigating crimes. Investigators and law enforcement agencies should embark more into this mechanism since in the present day; many activities are being carried out using computers and via the internet.