Computer Forensics

---

 Computer forensics is the process of investigating digital devices (like computers, smartphones, hard drives, USBs, etc.) to find evidence of criminal or unauthorized activity. 

It’s used in cases like:

• Cybercrimes (hacking, fraud, identity theft)
   
• Data breaches
   
• Employee misconduct
   
• Legal investigations

• Preserve the data: They make sure nothing is changed or damaged.
   
• Collect data: They extract files, emails, browser history, deleted files, etc.
   
• Analyze it: They try to understand what happened, who did it, when, and how.
   
• Present findings: They often write reports and may testify in court.

• Purpose: Recover deleted files, damaged hard drives, lost partitions.
   
• Tools/Providers: Stellar, Ontrack, Gillware, or local recovery labs.
   

• Purpose: Dig into email history, logs, USB usage, browser history, file tampering, etc.
   
• Use Cases: Internal investigations, evidence collection, fraud, infidelity, employee misconduct.
   
• Providers:
   
  • Cybersecurity or forensic firms (like Kroll, Cellebrite, BlackBag).
     
  • Local private investigators with digital forensics capability.
     

• Purpose: Detect rootkits, remote access trojans (RATs), spyware.
   
• Ideal for: People suspecting unauthorized access or spying.
   
• Tools Used: FTK Imager, EnCase, Autopsy, Wireshark, etc.
   

• Purpose: Evidence gathering admissible in court.
   
• Key feature: Must maintain chain of custody, create verified forensic images (bit-by-bit), and detailed documentation.
   
• Providers: Licensed computer forensic experts (often ex-law enforcement or certified professionals).