Education
Fact-checked

At WiseGEEK, we're committed to delivering accurate, trustworthy information. Our expert-authored content is rigorously fact-checked and sourced from credible authorities. Discover how we uphold the highest standards in providing you with reliable knowledge.

Learn more...

What is Forensic Computing?

Karyn Maier
Karyn Maier
Karyn Maier
Karyn Maier

Forensic computing refers to the use of technology as an investigative method with which to retrieve and substantiate digital data and media. Just as a medical examiner might determine time of death or how the deceased came in contact with poison, computer forensics relates to an examination of stored electronic data and how and when it got there. In fact, the only difference is that the forensic computing investigator is more likely to draw conclusions from dissecting a hard drive rather than a cadaver. In addition, careful handling and preservation of a potential “crime scene,” and the evidence collected from it, is at the core of every investigation.

It might be tempting to think it’s easy to gather information from a computer’s hard drive simply by viewing its contents onscreen, but this is far from the case. It’s might be even more tempting to believe that deleting a file or an email erases all traces of it, yet another incorrect assumption. In fact, forensic computing technicians are trained to locate hidden files where “breadcrumbs” of such files remain indefinitely. For that matter, some types of computer files leave traces behind known as “ghost files” long after they’ve been deleted. Basically, any time electronic data is created, archived, or disseminated, it can usually be traced and recovered.

Forensic computing can be used to recover data from a computer's hard drive.
Forensic computing can be used to recover data from a computer's hard drive.

The obvious roadblock to a computer forensics investigator is getting around use- created passwords that protect files and related information from being accessed. This is usually only a temporary situation, however. Not only does computer forensics training provide insight into cracking usernames and passwords, but also teaches the investigator how to get clues from encryption keys, random memory, and even from the person who created them.

There are many circumstances in which computer forensic services may be needed, with a great number being related to criminal or civil cases. For example, individuals suspected of possessing or distributing child pornography are often discovered through forensic computing techniques, many times after using online peer-to-peer networking services. In another scenario, an employer may wish to collect evidence from an employee’s computer in preparation for terminating and prosecuting the individual for embezzlement or breach of confidentiality.

Forensic computing often involves the protection and prevention of digital data corruption too. In fact, some technicians train to work in a specialized field of computer forensics to debug applications or detect unauthorized intrusions, such as database forensics and firewall forensics. In recent years, forensic computing has become particularly important in matters of international security. In fact, highly trained agents routinely observe and track Internet usage and communications that may be related to terrorist traffic.

Karyn Maier
Karyn Maier

Contributing articles to WiseGEEK is just one of Karyn’s many professional endeavors. She is also a magazine writer and columnist, mainly for health-related publications, as well as the author of four books. Karyn lives in New York’s Catskill Mountain region and specializes in topics about green living and botanical medicine.

Learn more...
Karyn Maier
Karyn Maier

Contributing articles to WiseGEEK is just one of Karyn’s many professional endeavors. She is also a magazine writer and columnist, mainly for health-related publications, as well as the author of four books. Karyn lives in New York’s Catskill Mountain region and specializes in topics about green living and botanical medicine.

Learn more...

Discuss this Article

Post your comments
Login:
Forgot password?
Register:
    • Forensic computing can be used to recover data from a computer's hard drive.
      By: merydolla
      Forensic computing can be used to recover data from a computer's hard drive.