Computer Forensics

What is Computer Forensics?

Computer forensics is the scientific process of capturing (imaging) and analyzing information stored in any electronic format, for the purpose of investigating allegations, to find the truth, with no predisposition as to the outcome. It is a highly technical discipline requiring a combination of unique skills relating to computer technology and software, formal investigative experience (law enforcement), proper evidence handling methods, and judgment. Computer forensics can be the key to learning the truth, taking appropriate action based on the facts, or winning the case.

What are the Challenges?

Many challenges are involved in effectively utilizing the power of computer forensics including:

Employers, HR representatives and internal and external legal counsel are often not aware of the information available on computer systems or the resources at their disposal to capture this information. Often, decisions are made based on interviews or perceptions when the facts are readily available on a nearby system.

Performing electronic discovery and forensic analysis on large volumes of information can be complex and time consuming. Given the unique skills required and the potential costs involved, it may be reserved for more involved situations. In truth, computer forensics can benefit any size case at an affordable price.

Often, a forensic expert is called into a situation very late in the process requiring the reconstruction of facts when faced with spoliation or partial loss of relevant evidence. This complicates the investigation and impacts the cost as well as the potential benefit. The use of proactive electronic discovery and analysis is not utilized as often as it should be.

Forensic expertise is difficult to develop and requires a range of skills. As a result, less skilled experts may provide findings in a format that is not useful for the investigation, attorney or court. In some instances, this can even lead to sanctions being handed down by the court. There may also be challenges in effectively communicating findings in an appropriate manner. Retaining the right expert is critically important.

In large cases, with computer evidence measured in gigabytes or terabytes, evidence searches need to be narrowed further in an effort to reduce cost. This requires judgment and a seasoned expert with an extensive background, or vital information will be missed.

An impartial or disinterested third party is the best forensic expert. Internal IT staff may have necessary technical skills to perform investigative activities. However, proper evidence handling, investigative credibility and impartiality often make the difference in court.

While the challenges are many, the opportunities and benefits are significant. Computer Forensic Services Inc.'s forensic team is expert at successfully managing these challenges.