computer forensics

Forensic investigators typically follow a standard set of procedures: After physically isolating the computer in question to make sure it cannot be accidentally contaminated, investigators make a digital copy of the hard drive. Once the original hard drive has been copied, it is locked in a safe or other secure storage facility to maintain its pristine condition. All investigation is done on the digital copy.

Investigators use a variety of techniques and proprietary forensic applications to examine the hard drive copy, searching hidden folders and unallocated disk space for copies of deleted, encrypted, or damaged files. Any evidence found on the digital copy is carefully documented in a "finding report" and verified with the original in preparation for legal proceedings that involve discovery, depositions, or actual litigation.

Computer forensics has become its own area of scientific expertise, with accompanying coursework and certification.

Read more about computer forensics: - Forensics.nl has many resources about computer forensics. - CIO Magazine has an article about computer forensics called "I.T. Autopsy." - LabMice.com offers more information about computer forensics.

Do you have something to add to this definition? Let us know. Send your comments to techterms@whatis.com

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Is security improved when the number of Internet gateways is reduced? A single entry point has often been thought easier to defend than multiple entry points. There are some caveats to reducing the number of Internet... Screencast: Nessus Peter Giannoulis of Bones Consulting demonstrates how Nessus can be used as a vulnerability assessment tool that enterprises can use to help protect... What are the pros and cons of shaping P2P packets? Packet shaping, a technique used to control computer network traffic, really isn't a security issue; it's a policy matter, says network expert Mike...

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Einstein  (SearchSecurity.com) Einstein is the network monitoring tool used by the United States federal government's Department of Homeland Security (DHS). Einstein is used to... footprinting  (SearchSecurity.com)