Computer Forensics:
Generally, forensics can be described as the process of using scientific knowledge in the gathering, evaluation, and presentation of evidence to the courts. Since forensics deal with the presentation of evidence to the courts, it basically deals with the analysis and recovery of hidden evidence. In this case, the hidden evidence may be in several forms including fingerprints, blood stains, and DNA evidence. On the other hand, computer forensics can be described as the discipline that merges fundamentals of law and computer science to gather and evaluate data from computer systems in forms that are admissible as evidence within the courts. These computer systems include wireless communications, computer networks, and storage devices. Computer forensics has emerged as a new discipline and field in the recent past due to the recent increase in cyber terrorism. Consequently, there is minimal standardization and uniformity across the computer forensics industry and the courts.
Importance of Computer Forensics:
The main goal of this process is to conduct structured analysis while preserving a well-documented series of evidence to determine the actual occurrences on a computer system and the responsible person or people. While this discipline has only developed in the recent past, it has become a renowned field of scientific expertise that involves various processes, necessary coursework, and certification.
Computer forensics is a vital field of scientific research because it helps in preserving important evidence that is admissible in a...
Through computer forensics, an organization can acquire important information regarding its network and help in the identification and prosecution of intruders of the network. Secondly, computer forensics can help in saving an organization's finances, especially with the increase in expenditures towards computer and network security. This field saves an organization's expenditures by reducing the money spent on intrusion-detection and vulnerability-assessment programs.
The Process Involved in Computer Forensics:
Computer forensics basically involves the use of various important processes since forensic investigators need to follow an established set of procedures. The first process or phase in this procedure involves the isolation of the specific computer to ensure that it cannot be tainted accidentally. The isolation of the computer helps in preserving the original media and data through the secure storage of the computer hard drive. However, a forensic image or copy of the original media is made and used for conducting analysis in contrast with the original media.
The second process is the identification procedure with which possible containers of the computer-related evidence is conducted. In most cases, this involves the use of log files, floppy disks, and hard disks since the containers are not primarily regarded as evidence itself. The identification stage includes the discovery of data and information that is relevant to the specific situation through various ways like conducting keyword searches (Hailey,…
