What Is Digital Forensics?

In the not too distant past, computers were monolithic devices which required a separate and specific climate controlled environment, and technicians with a specialized skill set to maintain them and make use of them. Only governments and large corporations could own them and pay the professionals who could communicate with them.

Now, computers are an ubiquitous part of life, and calculators and gaming systems have more computing power and data storage capacity than the early, giant computers.

Because computers are so prevalent, the amount of personal, corporate and government data stored on various devices increases with every passing minute. Security measures don’t always keep up with the latest technology, and digital media is often part of crime investigations. The critical nature of much of this data has created the need for a new science called digital forensics or sometimes, computer forensics.

Digital forensics is a branch of forensic science that includes the recovery, investigation and analysis of data found on digital devices such as computers, smart phones and media storage devices in such a manner that the results will be allowed to be entered as evidence in a court of law. In the private sector, it can be used to discover the nature and extent of an unauthorized network intrusion.

One goal is to preserve evidence in its most original form while performing a structured investigation. The process often includes the seizure, forensic imaging, and analysis of digital media, and the production of a report on the findings. This structured investigation needs to maintain a documented chain of evidence to find out exactly what happened on a computing device and who was responsible for it. There also needs to be a clear chain of custody for confidence that the data has not been tampered with or compromised. Data gathering incorrectly done can alter or corrupt the data being collected, rendering it useless to the investigation.

The first step is to preserve the crime scene by making a copy of all memory and hard disks. This preserves the state of the device, and allows it to be put back into use. After the data is preserved, the investigation for evidence can commence.

A computer forensics expert must show skills and experience by earning at least one of the major certifications in computer forensics. A competent examiner can recover deleted files, analyze Internet data to determine websites that were visited from a certain computer even in when the browser history and cache may have been deleted.

A computer forensics expert is also able to recover communications sent via chat or instant messenger. While performing the analysis, the expert can also recover deleted images and email messages. In the modern world of mobile Internet devices, a competent computer forensics expert will also be able to recover deleted data from mobile phones, including deleted text messages, call logs, emails, and the like.

During Digital Forensic investigations, specific steps and procedures requiring an added level of technical expertise must be followed to access, preserve, and analyze the data and to eliminate any risk of spoliation. Only trained professionals, who also possess IT knowledge, should be trusted to handle this process. This ensures that the data can be admitted by a legal team as evidence in a court of law.