The Many Faces of Computer Forensics

A Backup Article Contributed by Ashley Lister

The Many Faces of Computer Forensics

There are many different faces of computer forensics. What one person considers to be computer forensics is not necessarily how another person might see this fledgling science.

Computer Forensics Explained.

Computer forensics is the science of obtaining evidence from computers that will be sufficiently reliable and convincing to stand up in a court of law. The technicalities can be comparatively simple and involve little more than merely printing out an incriminating document. Or they can be extremely complicated and involve data reinstatement from deleted files.

Traditional Computer Forensics.

Traditionally , in court proceedings, the term "computer evidence" used to mean printed out copies of incriminating information that had been found on a computer's hard drive. However, with the advance of technology, tapes, discs and sometimes the whole computer have at times been presented as exhibits of evidence.

When print outs are displayed in court these can sometimes be generated from the original application, or by using specialist analytical and examination tools. A lot of this depends on the way the information has been recovered from the drive.

Variations of Computer Forensics.

And, while it was once imperative that a computer forensic investigator had unfettered access to the computer he was examining, investigators now have ways of collecting evidence from remote computers. Obviously this requires a suitable connection such as a phone line or network connection but it means that, in some cases, the computer forensic expert does not have to visit the scene of a suspected crime.

THis can be boon when an expert is unable to reach the location of the computer, or when the expert's presence at the scene of a potential cyber-crime might cause more problems than it ultimately solves.

Originally computer evidence came in the form of spreadsheets that showed illicit transactions, or text documents that, by their existence, were tantamount to being an admission of guilt. More recently photographic evidence has been taken from computers and, in itself, has often been enough to secure a successful prosecution and conviction.

However, aside from those files and pictures that were traditionally thought of as incriminating evidence, competent computer forensic experts can now track activities across a computer network, including the internet. This means that anyone who has been accessing illegal websites can be easily charged and prosecuted for their crimes, with a full complement of evidence to prove their guilt.

These procedures form only a part of what we refer to as computer forensics. Other fringes of this field of science include the analysis and tracking of telephone calls and bank account transactions. There are also areas of computer forensics that are used to provide graphic illustrations for the aid of the court room. These can show pictures that clarify the complexities of cases that would be otherwise difficult to understand. In some of the more complicated cases of internet fraud, these graphic illustrations can be invaluable.

Yet, whichever branch of computer forensics is being used, it is hoped by all that it will be effective in its use against cyber-criminals.