Before, such data are considered as evidence the rules of evidence are checked and the legal process. However, with electronically stored information (e.g. email messages, digital images, network log files, etc.) can be found on computer hard drives, servers and other digital storage media (e.g. computers, thumb drives, DVD, CD-ROM, mobile phones). It includes any device that has a digital brain to store information. The computer forensics is used to create a digital picture of the ESI; therefore the examiner can later look for digital evidence on the acquired media and attempt to re-create a time-line of how the data was used in relation to the matter under investigation.

Computer forensics is a specialized service that provides and documents digital evidence for possible use in litigation. A computer forensic investigation is highly disciplined and the results can be repeated and proven to be accurate, which is crucial for any digital evidence to be admissible in court.

There are some previous cases, which the investigator never taken serious, therefore the cases were ruled out because of lack of proper evidence. For example in 1986, an astronomer at the University of California at Berkeley who was assigned to solve a vexing but apparently minor problem at the Berkeley computer laboratory. Berkeley was running...

Because these programs were tracking the same information, their results should have been the same. Yet for some unknown reason, there was a $.75 discrepancy.
Clifford Stoll's investigation revealed that an unauthorized user had penetrated the Berkeley system. This hacker had given himself an account by creating a user identification code in one accounting system, but had failed to create a similar account in the second system. Put another way, one accounting system recognized his presence and billed him while the other did not.

When investigation was completed, it revealed that the hacker was a German citizen. But the investigator didn't make any arrest and take him to court simple because the investigator felt that there was no enough evidence to prosecute him.

In conclusion, computer crime has increased tremendously in the last few years. Therefore proper knowledge of investigation is needed to assist prosecutors in coming up with evidences which relate to computer crimes. This would help in convincing the jury and therefore reduce such cases.

Refeerence

Scott Charney, Kent Alexander (2009). Computer Crime Research Center

Jim Corbett (2007)Forensic Computer Analyst