Forensic Computer Science deals with the identification, preservation and extraction of magnetically encoded evidence from computer storage media and the documentation of the findings using legally accepted methods and procedures. It essentially relies upon the inherent security weaknesses of computer operating systems to identify and extract data that is usually unknown to the computer user. Other popular and descriptive names include: Electronic Document Discovery, Computer Risk Assessment and Computer Forensics. All of the following pertain:

• Often the computer user that created the evidence does not
  know the evidence exists. Many times ‘electronic finger prints’
  are left in bizarre and unexpected areas.
  
  
• Potential computer evidence (data) is many times password
  protected and/or encrypted. It can also be compressed or encoded.
  
  
• Frequently the computer evidence (data) is in the form
  of ‘data fragments’ that may include binary data, which
  potentially precludes the viewing or printing of the data
  without the use of special software and/or filtering methods.

 

In the Law Enforcement World, forensic
tools/techniques are used to:

• Identify and document evidence of criminal violations
  
  
• Discover ‘secrets’ for intelligence gathering purposes
  
  
• Defeat the ‘crooks’ computer security
  
  
• Enhance the law enforcement agency’s computer security
  
  
• Tie discs and portable media storage devices to specific
  desktop, laptop and notebook computers
  
  
• Identify Internet E-mail and browsing patterns
  tied to criminal activity
  
  
• Identify criminal associates and conspirators

 

In the Corporate and Government World, forensic
tools/techniques are used to:

• Identify computer security weaknesses
  
  
• Identify internal audit issues regarding violations
  of corporate policy
  
  
• Discover evidence in civil and criminal cases
  
  
• Identify the source of trade secrets thefts and abuses
  
  
• Enhance corporate and government computer security
  
  
• Tie discs and portable media storage devices to specific
  desktop, laptop and notebook computers
  
  
• Identify Internet corporate and account abuses