NCJ Number
186015
Journal
Forensic Science Communications Volume: 2 Issue: 4 Dated: October 2000 Pages: 1-13
Date Published
October 2000
Length
13 pages
Annotation
This paper examines the process of recovering and examining computer forensic evidence.
Abstract
Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that have been processed electronically and stored on computer media. As a forensic discipline, nothing since DNA technology has had such a large potential effect on specific types of investigations and prosecutions. Valid and reliable methods to recover data from computers seized as evidence in criminal investigations are becoming fundamental for law enforcement agencies worldwide. The methods must be technologically robust to ensure that all probative information is recovered. They must also be legally defensible to ensure that nothing in the original evidence was altered and that no data were added to or deleted from the original. Computer forensic science protocols should be written in a hierarchical manner so that overarching principles remain constant, but examination techniques can adapt quickly to the computer system to be examined. References