Forensic Computer Investigations Should Not Cut Corners
This post was submitted on - June 27, 2008
When a forensic computer investigator is needed to help out with a criminal or civil case, clients are often unsure what to expect. If a reputable investigator is hired to help out, credentials will generally be long and corner cutting will not be a part of the proposition. In fact, investigations can be a little longer and more tedious than many people realize.
A good forensic computer investigator will not promise results one way or another. It is virtually impossible for a computer forensic expert to say whether evidence exists on a computer or even if it can be retrieved prior to conducting a thorough investigation. The process becomes tedious because it is the computer forensics investigator’s job to make sure if evidence does exist that it is located and preserved for presentation.
To make certain an investigation goes as it should and has the best chances for success, reputable forensic computer experts will:
Begin with a cursory examination – One of the first steps in many computer forensic investigations involves a basic scan of a computer to help the professional determine if evidence might be found on it. This will take place prior to a more thorough exam that can take a while to complete. If the investigator feels there might be important data left on a computer that can be recovered, the case will move on to the next phase.
Involve hard drive cloning – Should the cursory scan reveal the likelihood that a hard drive contains valuable data, an actual cloning of that drive will be performed. This is done to help the computer forensic expert ensure that original evidence is preserved in its entirety on the implicated machine.
Move on to a more thorough search – Once a clone drive is completed, an investigator will use it to perform more in-depth searches for data. The best pros can often restore lost files, repair damaged data and even track Internet usage and recover deleted documents.
The hunt for evidence on a forensic computer case does not leave room for corner cutting. If data is recovered, it will need to stand up in court in many cases. The best forensic computer pros know how to make this happen.
Popularity: 57% [?]