Forensics is the use of scientific knowledge to collect, analyze, and present digital evidence to court. Digital Forensic examiners draw on an array of techniques for discovering data from a computer, often for recovering deleted, encrypted, or damaged files (graphics, documents, images and so forth). All of this information is crucial, especially during discovery, prior to depositions, or in preparation for criminal or
civil litigation. Much of the information to be recovered may not be found in simply deleted files. It may be hidden in other data files such as HTML, e-mail entries, and information recovered from hard disk areas such as the virtual memory, slack space, or recycle bin. The manner in which digital evidence is collected and preserved is crucial to any investigation or legal matter. The following are general guidelines companies should
adhere to when collecting electronic evidence. Whenever possible a digital forensic examiner should be consulted. All suspects and witnesses should be removed from the general area where the electronic device is being stored. If this is not possible, the electronic evidence should be collected or preserved after regular business hours,
when any suspects and witnesses are not present. Also, whenever possible, the suspects and witnesses should not be notified that evidence is being collected from an electronic device assigned to them. Ovie L. Carroll |