What Does a Computer Forensics Examiner Do?

Computer investigation and forensics is a branch of forensic science. Similar to forensics, computer investigation and forensics are related to the process of obtaining electronic evidence from a computer and analyzing it. In recent years, more and more electronic evidence has been involved in various cases, and computer investigation and evidence collection has gradually become a popular specialty.

Computer Investigation and Forensics

Computer investigation and forensics is a branch of forensic science. Similar to forensics, computer investigation and forensics are related to the process of obtaining electronic evidence from a computer and analyzing it. In recent years, more and more electronic evidence has been involved in various cases, and computer investigation and evidence collection has gradually become a popular specialty.

Chinese name

Computer Investigation and Forensics

Foreign name

Computer Forensics

Attributes

profession

Belong to

Forensic medicine

With the popularity of mobile phones, personal PDAs, and other electronic products in recent years, the source of computer investigation and forensics has also shifted from computers to other types of electronic products. Therefore, computer investigation and forensics are sometimes referred to as "digital investigation and forensics." .

Enabling the results of the investigation to be examined by the court.

computer

Electronic evidence can be divided into "dead" evidence and "live" evidence: the former includes collected

First, collect evidence as early as possible and ensure that it has not been damaged in any way;

Second, "evidence continuity" (sometimes referred to as "chain of custody") must be guaranteed, that is, when the evidence is formally submitted to the court, it must be able to account for the period from when the evidence was originally obtained to when it appears in court Any change, of course, it is best not to change anything;

Finally, the entire inspection and evidence collection process must be supervised, that is, all investigation and evidence collection work performed by experts appointed by the plaintiff should be supervised by experts appointed by other parties.

It must be possible to account for any change in the evidence from its original state of acquisition to its appearance in court, and of course it is better not to change it. Especially important is that

With these basic principles in mind,

Preparation for Preparation

Equipment preparation

Evidence protection

Equipment storage

Evidence Collection

Original evidence preservation

Evidence analysis

Forensic analysis

Conclusion report

Evidence submission

Evidence display

Return of evidence

As a new thing, electronic forensics faces many challenges. More and more anti-investigation methods and software are used by criminals. In the face of these criminals, the extraction of evidence becomes extremely difficult or no evidence can be found at all. But with the development of electronic forensics systems and the improvement of laws, justice will definitely defeat evil.