Computer forensics (or digital discovery as it is also know), examines computer data and information from computer storage media so that it can be made use of as evidence in a court of law or to answer a particular legal issue.
For instance, in professional investigations, a computer forensics investigator might use digital forensics at the instruction of a barrister for a defendant in a public case. Evidence can be gathered to prove that an employee has used company resources for personal ends such as buying goods online or visiting internet sites that are against company company rules. In these cases, the employee might be subject to disciplinary action and maybe prosecution.
Digital evidence might be able to show that an employee has violated their contract of employment. For example, evidence may be retrieved showing an employee accessed records or other information without company authorisation, or evidence may be recovered proving one employee has harassed another, or sensitive company data has been stolen.
Our everyday reliance on digital technologies means that computer systems are often central to a crime. Typical examples are in cases of fraud, copyright violation, email, document theft and tampering, internet histories and illegal images, where the computer is frequently the device used to perpetrate the crime. Fortunately, the computer often records everything it is told to do, and these are the very records that the computer forensic specialist is able to find and present.