Computer forensics, or digital forensics, is a fairly new field. Computer forensics investigators, also known as computer forensics specialists, computer forensics examiners, or computer forensics analysts, are charged with uncovering and describing the information contained on, or the state or existence of, a digital artifact. Digital artifacts include computer systems, hard drives, CDs, and other storage devices, as well as electronic documents and files like emails and JPEG images. The fast-growing field of computer forensics includes several branches related to firewalls, networks, databases, and mobile devices. Digital forensics technicians can find work with many types of organizations: government (local, state, and federal), accounting firms, law firms, banks, and software development companies. Essentially, any kind of organization that has a computer system may have a need for a digital forensics specialist. Some digital forensics specialists opt to start their own businesses, giving them an opportunity to work with a variety of clients. Computer forensics investigators provide many services based on gathering digital information, from investigating computer systems and data in order to present information for legal cases to determining how an unauthorized user hacked into a system. A digital forensics examiner does many things in the course of these tasks – protects the computer system, recovers files (including those that were deleted or encrypted), analyses data found on various disks, and provides reports, feedback, and even testimony when required. The employment outlook for digital forensics examiners and investigators is favorable due to the rapid growth of crimes involving computers (cybercrime).
After the successful completion of this course, the learner will be able to:
A. Understand the importance of a systematic procedure for investigation of data found on digital storage media that might provide evidence of wrong-doing.
B. Understand the file system storage mechanisms of the operating systems.
C. Use tools for faithful preservation of data on disks for analysis.
D. Find data that may be clear or hidden on a computer disk.
E. Learn the use of computer forensics tools used in data analysis, such as searching, absolute disk sector viewing and editing, recovery of files, password cracking, etc.
F. Understand how to present the results of disk data analysis in a court proceeding as an expert witness.