Computer Forensics is the preservation, recovery and investigation of the data present in the hard disk of a computer, in a way that the evidence it produces can be used in a criminal or civil court, or other legal or disciplinary court hearing. This includes any previously deleted data that can be recovered using computer forensic tools and techniques.
A computer forensic examination is typically used as a reactive measure to confirm or prevent a crime or violation.
Computer and network surveillance:
Surveillance of computer and network is the process of tracking computer activity and data stored on a hard disk drive (HDD), or transfer of data over computer networks. The aim is to monitor activities or capture information from a computer, a network, or other devices.
Why computer and network surveillance?
- To protect children from the online dangers such as chatting with unknown people, gambling and bullying.
- To monitor how much time employees spend browsing the Web while they are working.
- Monitoring of electronic media as part of the reporting process for employees leaving a company.
The five steps of Ethical Detectives to obtain computer forensic evidence are:
- Collection of the data