Computer Forensics

Computer forensics is the study of evidence from attacks on computer systems in order to learn what has occurred, how to prevent it from recurring, and the extent of the damage. It can be for performing the root cause analysis of a computer system that failed or is not operating properly, or to find out who is responsible for misuse of computer systems, or who committed a crime using a computer system or against a computer system. This type of information cannot be accessed by just any member of law enforcement. The information is gathered during a computer forensics investigation that is not typically available or viewable by the typical user. These people are known as ballistics professionals with special skills and tools.

Although many people think otherwise, far more information is retained on a computer than they realize. This is why computer forensics are capable of finding evidence of, or even completely recover, lost or deleted information, even if it was intentionally deleted by the user. Although it is most often associated with the investigation of a wide variety of computer crime, computer forensics may be useful in criminal cases, civil disputes, and human resources/employment proceedings. Computer forensics has become its own area of scientific expertise, with accompanying coursework and certification. http://searchsecurity.techtarget.com/definition/computer-forensics  http://einvestigations.com/computer-forensics/what-is-computer-forensics/