Computer Forensics Simple English Wikipedia The Free Encyclopedia

Leo Migdal

-Dec 7, 2025, 9:16 AM

computer forensics simple english wikipedia the free encyclopedia

Computer forensics (also known as computer forensic science)[1] [2] is a branch of digital forensic science. That branch is about evidence found in computers and digital storage media. Computer forensics (also known as computer forensic science)[1] is a branch of digital forensic science pertaining to evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing, and presenting facts and opinions about the digital information. Although it is most often associated with the investigation of a wide variety of computer crime, computer forensics may also be used in civil proceedings. The discipline involves similar techniques and principles to data recovery, but with additional guidelines and practices designed to create a legal audit trail.

Evidence from computer forensics investigations is usually subjected to the same guidelines and practices as other digital evidence. It has been used in a number of high-profile cases and is accepted as reliable within U.S. and European court systems. In the early 1980s, personal computers became more accessible to consumers, leading to their increased use in criminal activity (for example, to help commit fraud). At the same time, several new "computer crimes" were recognized (such as cracking). The discipline of computer forensics emerged during this time as a method to recover and investigate digital evidence for use in court.

Since then, computer crime and computer-related crime has grown, with the FBI reporting a suspected 791,790 internet crimes in 2020, a 69% increase over the amount reported in 2019.[2][3] Today, computer forensics is used... The discipline also features in civil proceedings as a form of information gathering (e.g., Electronic discovery). Forensic techniques and expert knowledge are used to explain the current state of a digital artifact, such as a computer system, storage medium (e.g., hard disk or CD-ROM), or an electronic document (e.g., an... In a 2002 book, Computer Forensics, authors Kruse and Heiser define computer forensics as involving "the preservation, identification, extraction, documentation and interpretation of computer data".[5] They describe the discipline as "more of an art... However, while several methods can be used to extract evidence from a given computer, the strategies used by law enforcement are fairly rigid and lack the flexibility found in the civilian world.[6] Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery, investigation, examination, and analysis of material found in digital devices, often in relation to mobile devices and...

Digital forensics investigations have a variety of applications. The most common is to support or refute a hypothesis before criminal or civil courts. Criminal cases involve the alleged breaking of laws that are defined by legislation and enforced by the police and prosecuted by the state, such as murder, theft, and assault against the person. Civil cases, on the other hand, deal with protecting the rights and property of individuals (often associated with family disputes), but may also be concerned with contractual disputes between commercial entities where a form... Forensics may also feature in the private sector, such as during internal corporate investigations or intrusion investigations (a special probe into the nature and extent of an unauthorized network intrusion).[3] The technical aspect of an investigation is divided into several sub-branches related to the type of digital devices involved: computer forensics, network forensics, forensic data analysis, and mobile device forensics.[4] The typical forensic process...

As well as identifying direct evidence of a crime, digital forensics can be used to attribute evidence to specific suspects, confirm alibis or statements, determine intent, identify sources (for example, in copyright cases), or... Digital forensics is a forensic science where experts look at computer devices to help solve crime. It can also include mobile phones. The experts who do digital forensics are often called "analysts" or "investigators". When an expert is asked to look at a computer it is called an "investigation". A digital forensics investigation happens when someone is blamed for a crime that includes using a computer.

The expert will look for evidence about the crime. They will try to prove whether the person is to blame or not. Sometimes investigations are used in disputes between companies and/or people (known as civil law). These may not involve a crime. Instead the expert is asked to find out information about a person or company by looking at their computer. There is a specific word used to describe this type of investigation, it is "eDiscovery".

Another use of digital forensics is called "intrusion detection". It happens after a hacker breaks in to a computer network. After the break in an expert is often asked to look at the networked computers to try and find out how it happened. Forensic science (or forensics) is when science works to answer questions a lawyer might ask. Most often, forensics is about proving that someone was present at a place where a crime was committed. Specialists take samples which are later analyzed in a laboratory.

Most forensic tests can take from 1 hour to one year, and investigators need to double (and triple) check the answer, so they know that the answer is the right answer. If a forensics team made a mistake the wrong person could be jailed, or they could get into trouble themselves. Samples commonly taken include fingerprints. People also look for other things that could be used, for example a few hairs (or pieces of skin) and autopsy if dead. Samples like hair or skin can be use for DNA testing, which allows to tell the gender of the person the hair is from, amongst others. When someone is accused of committing the crime, these pieces of evidence can then be matched up.

Then, if they are correct, the person is charged. Computer Forensics is a scientific method of investigation and analysis in order to gather evidence from digital devices or computer networks and components which is suitable for presentation in a court of law or... It involves performing a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computer and who was responsible for it. The procedure starts with identifying the devices used and collecting the preliminary evidence on the crime scene. Then the court warrant is obtained for the seizure of the evidence which leads to the seizure of the evidence. The evidence are then transported to the forensics lab for further investigations and the procedure of transportation of the evidence from the crime scene to labs are called chain of custody.

The evidence are then copied for analysis and the original evidence is kept safe because analysis are always done on the copied evidence and not the original evidence. The analysis is then done on the copied evidence for suspicious activities and accordingly, the findings are documented in a nontechnical tone. The documented findings are then presented in a court of law for further investigations. Cybercrime is on the rise, and jobs in computer forensics are in demand. Learn more about this field and how you can enter it with the following article. Computer forensics is also known as digital or cyber forensics.

It is a branch of digital forensic science. Using technology and investigative techniques, computer forensics helps identify, collect, and store evidence from an electronic device. Computer forensics can be used by law enforcement agencies in a court of law or by businesses and individuals to recover lost or damaged data. Computer forensics becomes more relevant daily as the world becomes increasingly digitally connected. The management of digital evidence is critical for solving cyber crimes and recovering important, compromised data. A computer forensics investigator's job is to collect, examine, and safeguard this evidence.

Computer forensics always involves gathering and analyzing evidence from digital sources. Some common types include: Database forensics: Retrieval and analysis of data or metadata found in databases The Certified Forensic Computer Examiner (CFCE) is a certification demonstrating competency in computer forensics. The International Association of Computer Investigative Specialists (IACIS), a non-profit, entirely volunteer organization of digital forensic experts, administers the CFCE training and certification.[1][2] In 1990, IACIS was established.

When the training was extended to include a review of Windows-based computers in 1998, the CFCE was launched. Although the MAC OS operating system and related file systems are covered in the course materials as well, the certificate exclusively certifies Windows proficiency.[3] One of the majorities of non-tool certifications in computer forensics for both active and retired law enforcement officers is the CFCE.[4][5] Members of certain organizations, like Miami-Dade Police's Computer Forensics Laboratory, must earn and keep this accreditation.[6] This category has only the following subcategory. The following 37 pages are in this category, out of 37 total.

This list may not reflect recent changes. Computer forensics, also known as digital forensics, computer forensic science or cyber forensics, combines computer science and legal forensics to gather digital evidence in a way that is admissible in a court of law. In the same way that law enforcement officials comb crime scenes for clues, computer forensics investigators search digital devices for evidence that lawyers can use in criminal investigations, civil cases, cybercrime investigations and other... And like their law enforcement counterparts, computer forensic investigators need to be experts not only in hunting for digital evidence, but in collecting, handling and processing it to ensure its fidelity and its admissibility... Computer forensics are closely related to cybersecurity. Computer forensics findings can help cybersecurity teams speed cyberthreat detection and resolution, and prevent future cyberattacks.

An emerging cybersecurity discipline, digital forensics and incident response (DFIR), integrates computer forensics and incident response activities to accelerate remediation of cyberthreats while ensuring that any related digital evidence is not compromised. Join security leaders who rely on the Think Newsletter for curated news on AI, cybersecurity, data and automation. Learn fast from expert tutorials and explainers—delivered directly to your inbox. See the IBM Privacy Statement. Your subscription will be delivered in English. You will find an unsubscribe link in every newsletter.

You can manage your subscriptions or unsubscribe here. Refer to our IBM Privacy Statement for more information.

Computer Forensics Simple English Wikipedia The Free Encyclopedia

People Also Search

Computer Forensics (also Known As Computer Forensic Science)[1] [2] Is

Evidence From Computer Forensics Investigations Is Usually Subjected To The

Since Then, Computer Crime And Computer-related Crime Has Grown, With

Digital Forensics Investigations Have A Variety Of Applications. The Most

As Well As Identifying Direct Evidence Of A Crime, Digital