|
Q:
What is computer forensics ?
A: Computer forensics is a
specialized form of data recovery, which additionally involves
analysis and uncovering of hidden information and often
is followed up with testimony in court.
Computer Forensics
is practice and methodology that involves:
|
|
Electronic Imaging,
or making an identical copy of the original media. |
|
|
Electronic Discovery,
or finding the missing or relevant data. |
|
|
Forensic Analysis of
discovered information, or finding the explanation for
how, why and/or when the data or media got to be in
its current condition. |
|
|
Preparation of information in a manner useful to
the client, such as in oral or written reports, or
as files on a CD-ROM.
|
|
|
Presentation of findings
to the client or attorney, such as in written, oral
and/or electronic reports, and |
|
|
Testimony in a court
of law, when necessary, by an Expert Witness, including
deposition and jury trial. |
Q: What
is Electronic Imaging?
A: It is of the greatest importance
to make identical, bit-for-bit copies of any and all electronic
media being investigated. Many off-the-shelf programs do
not copy the "hidden areas" of the media, rendering some
of the most useful areas for possible discovery unreachable.
Any work done on the original and/or improper copying may
cause substantial spoliation of evidence, and render evidence
unusable, and desired results unattainable.
Q: What
is Electronic Discovery?
A: Hiding in the hidden or
partially used areas of computer and electronic media a
tremendous store of usable information sits. Files and portions
of files that individuals have attempted to delete, erase,
shred, sabotage, alter, backdate, or otherwise make inaccessible
are not typically lost when an attempt is made to lose them.
Using several methods of electronic discovery, the computer
can usually be made to give up these secrets.
Q: What
is Forensic Analysis?
A: Investigation to determine
the essential features of the information or material at
hand, separating it into its constituent components, for
presentation in a court of law. In other words, analyzing
the findings produced in the electronic discovery so as
to make them usable in a court case.
Q: What
is data recovery?
A: Data Recovery is the process
of retrieving the data from damaged disk drives, media,
computers, peripherals or operating systems.
Q: What
is data transfer?
A: Simply put, data transfer
is the process of moving or converting computer data from
one media, operating system, application, or platform to
another. This can involve just taking the data off of one
disk drive and putting it on another, or onto CD-ROM.
|
