Internet
Fact-checked

At WiseGEEK, we're committed to delivering accurate, trustworthy information. Our expert-authored content is rigorously fact-checked and sourced from credible authorities. Discover how we uphold the highest standards in providing you with reliable knowledge.

Learn more...

What Is Digital Forensics?

Mary McMahon
Mary McMahon
Mary McMahon
Mary McMahon

Digital forensics is the evaluation of digital material for legal purposes. A technician who specializes in digital forensics can assist with criminal and civil investigations and may offer testimony in court about the kind of evidence uncovered and its implications. Technicians may evaluate the contents of hard drives and other storage devices and can also engage in activities like tracing the steps of a hacker, testing security measures, or recovering damaged digital data like photographs on a memory card.

To work in this field, technicians need training in proper forensic procedure as well as technical skills. There are very strict rules about evidence control and preservation put in place to protect the integrity of court cases. The technician needs to be familiar with chain of evidence procedures, nondestructive testing techniques, evidence logging, and other matters so her evidence will be accepted in court. She also needs to learn about how to extract digital evidence and how to evaluate systems that may be password protected, corrupted, or otherwise difficult to access.

Computer forensics specialists can sometimes retrieve information that was meant to be destroyed or deleted.
Computer forensics specialists can sometimes retrieve information that was meant to be destroyed or deleted.

Sources of material for digital forensics technicians to look at can be quite varied. Officers may collect digital evidence at a scene that needs to be processed, and it is also possible to subpoena evidence. The technician may travel to the scene to personally collect the evidence. He will check to confirm that the all the material is present and can reduce the risks of damage or sabotage. Skilled technicians also know what to look for on site and may identify an issue that a regular law enforcement officer does not have the training to spot.

"Deleting' data from a hard drive doesn't actually permanently erase it.
"Deleting' data from a hard drive doesn't actually permanently erase it.

In digital forensics, technicians look for any and all evidence relevant to a case at hand. This includes any material that a suspect has attempted to destroy or hide. There are techniques available to extract information that users tried to delete or destroy. The technician can also recover information that is inadvertently lost or damaged. If a hard drive is discovered in a home after a flood, for example, the technician may be able to access the data and put it in a safe format for further evaluation.

The work of digital forensics is a constantly evolving field. Technicians need to keep up with the latest developments so they can offer the highest quality work to their employers. This may require joining professional organizations, attending conferences, and reading through research journals and other materials. Many employers will help cover the costs of professional development and will sponsor technicians who need to travel to develop more skills.

Mary McMahon
Mary McMahon

Ever since she began contributing to the site several years ago, Mary has embraced the exciting challenge of being a WiseGEEK researcher and writer. Mary has a liberal arts degree from Goddard College and spends her free time reading, cooking, and exploring the great outdoors.

Learn more...
Mary McMahon
Mary McMahon

Ever since she began contributing to the site several years ago, Mary has embraced the exciting challenge of being a WiseGEEK researcher and writer. Mary has a liberal arts degree from Goddard College and spends her free time reading, cooking, and exploring the great outdoors.

Learn more...

Discuss this Article

Post your comments
Login:
Forgot password?
Register:
    • Computer forensics specialists can sometimes retrieve information that was meant to be destroyed or deleted.
      By: dbj65
      Computer forensics specialists can sometimes retrieve information that was meant to be destroyed or deleted.
    • "Deleting' data from a hard drive doesn't actually permanently erase it.
      By: sg
      "Deleting' data from a hard drive doesn't actually permanently erase it.