Computer Forensics

Definition(s)

  • Computer forensics is the use of specialized techniques for recovery, authentication and analysis of electronic data when a case involves issues relating to reconstruction of computer usage, examination of residual data, and authentication of data by technical analysis or explanation of technical features of data and computer usage. Computer forensics requires specialized expertise that goes beyond normal data collection and preservation techniques available to end-users or system support personnel.  1  2
  • Similar to all forms of forensic science, computer forensics is comprised of the application of the law to computer science. Computer forensics deals with the preservation, identification, extraction, and documentation of computer evidence. Like many other forensic sciences, computer forensics involves the use of sophisticated technological tools and procedures that must be followed to guarantee the accuracy of the preservation of evidence and the accuracy of results concerning computer evidence processing.  3
  • The use of specialized techniques for recovery, authentication, and analysis of computer data, typically of data which may have been deleted or destroyed.  4

Notes

  1. Kroll Ontrack, Glossary of Termshttp://www.krollontrack.com/glossaryterms
  2. Merrill Corporation, Electronic Discovery Glossary.
  3. Vinson & Elkins LLP Practice Support, EDD Glossary.
  4. Legal Electronic Document Institute, Basic Principles of Automated Litigation Support (2005).