Computer forensics is the application of investigation and analysis technology in order to gather and preserve evidence. In other words, computer forensics is used to gather evidence that can be used inside of a court room. The main goal of computer forensics is to perform a structural investigation while still maintaining a chain of evidence to find out who is behind who is behind the problem that is happening in the computer. Before the device is looked at, experts make sure that the computer is isolated and not contaminated.
Once the device is isolated and clear of any sort of contamination's, investigators make a copy of the device's storage media. This is done to preserve the original copy of the storage media. once a copy has been made, it is locked in a safe to maintain it's condition. Once the condition is maintained, investigators use different techniques to examine the copy of the storage media and search for hidden folders. Any evidence that is found on the copy is documented and verified with the original copy in preparation for legal proceedings that involve discovery, depositions or litigation.
Source: http://searchsecurity.techtarget.com/definition/computer-forensics
No comments:
Post a Comment