|
|
Computer Forensics
Think... of a computer as a room containing many filing cabinets, each full of documents, pictures, and correspondence that may be relevant to your inquiry or lawsuit. Imagine further that in addition to the files intended to be stored, the cabinets contain many items that were intentionally shredded. And finally, the cabinets contain parts of documents that were never intended to be saved at all, but were merely brought into the room on a temporary basis.
Now, you want to access this potential wealth of information, but how do you do it? If you simply open the door to the room, you will change dates on some of the documents. Worse, if you go into the room, open a file drawer, and start looking through the documents, you may permanently alter the documents and destroy any potential evidentiary value. Additionally, you find that by just looking through the drawers, you cannot see the files intended to be shredded or that passed through the room on a temporary basis. Finally, you find that some of the cabinets have locks for which you don’t have the key, and many of the important documents are written in a foreign language that you cannot read.
This scenario highlights the need and value of computer forensics. Using highly-specialized methods, protocols and software, the room, cabinets, files, and documents can be accessed without any alteration. The “shredded” files and temporary information become visible and useful. The cabinets can be unlocked and the foreign language documents translated. And finally, all the relevant information found can be presented in a manner sufficient for court admissibility.
|
|
