FAQ’s

Home  >>  FAQ’s

What is Computer Forensics?

Generally, computer forensics is considered to be the use of analytical and investigative techniques to identify, collect, examine and preserve electronic evidence/information which is magnetically stored or encoded on a variety of electronic devices. Computer forensics involves scientific investigation and analysis techniques to examine the left-behind data for the purpose of determining legal evidence.

What is the objective of computer forensics work?

Computer forensics typically provides digital evidence of a general or specific activity.

Why initiate computer forensics work?

Computer forensics investigation can be initiated for a variety of reasons. The most high profile reasons include criminal investigation or civil litigation. However, computer forensic techniques can be of value in a wide variety of situations, including human resources activities such as email tracking, server or network security breaches, or for tasks as simple as re-tracking steps taken when data has been lost.

What are the common scenarios that should prompt you to contact a computer forensics expert?

  • Employee situations such as internet abuse, harassment, termination
  • Suspected unauthorized disclosure of corporate information and data
  • Industrial espionage
  • Damage assessment following a network or security breach
  • Criminal fraud and deception cases
  • General criminal cases

When should a computer forensics expert be contacted about a situation in which their services may or may not be needed?

Unfortunately, calling a computer forensics expert into a situation after it is full-blown or in litigation requires the reconstruction of facts and the possibility of evidence being lost and increased risk of spoliation. To keep costs down and to safeguard evidence that can make for a stronger case, use proactive electronic discovery and analysis to protect your company, your clients, or yourself and preserve evidence early.

How is a computer forensic investigation approached?

Computer forensics investigations require skilled and impartial experts who have been diligently trained to perform this scientific recovery and data analysis. Computer forensic experts use many methods to capture computer system data, and recover deleted, encrypted, or damaged file information. In large cases, with computer evidence measured in gigabytes or terabytes, evidence searches must be narrowed further in an effort to reduce cost. A seasoned computer forensics expert will ensure vital information is not missed.

Is there anything that should NOT be done during an investigation?

Yes. It is important to avoid looking into a computer when a computer forensics investigation is needed or warranted. You risk changing the date/time stamps of files or changing data itself. When eDiscovery is initiated in a legal case, this can be construed as evidence tampering, which can seriously negatively impact a case.

Can an IT professional handle a company’s computer forensics investigations?

Performing eDiscovery and computer forensics analysis on large volumes of information can be complex and time consuming. Given the unique skills, training and technical equipment required including the potential costs involved, companies, attorneys and governmental institutions would be best served to engage a professional. Computer forensics can benefit any size case at an affordable price. Less skilled experts may produce findings that are not useful for an investigation, which could result in sanctions being handed down by the court.


Conducting computer forensics work is highly complex and challenging. Intelligent Computer Forensics experts are professionally trained to successfully manage these challenges.

Questions? Please email info@icforensics.com

One Comment so far:

  1. Genevieve McGinty says:

    Does this work?

Leave a Reply

Your email address will not be published. Required fields are marked *