The role of computer forensics in criminal investigations

Abstract

Computer forensics is a relatively new term to those outside the field of computer science. The term refers to the use of computer science techniques to recover evidence from computerised devices and then to present that evidence in criminal trials. With more criminal activities containing some element of computer-related assistance, understanding of computer forensics and data recovery are becoming increasingly important. The role of computer forensics, however, extends beyond the realm of criminal investigations. Corporate companies are also finding uses for the technology to maximise worker productivity and minimise illegal activities by employees. This chapter will examine the basics of computer forensics, including: what is meant by the term ‘computer forensics’; how computers store data; how computer forensics programs operate; how the computer forensics process itself works; and finally the admissibility of computer forensics-related evidence. The chapter will also briefly address some of the problems associated with integrating computer forensics programs into law enforcement agencies.