Файл:Почта3.JPG

Introduction Computer forensics may be the practice of collecting, analysing and reporting on digital data in a way which is legally admissible. It may be utilized in the detection and prevention of crime and in any dispute exactly where evidence is stored digitally. Computer forensics has similar examination stages to other forensic disciplines and faces exact same concerns.

About this guide This guide discusses laptop or computer forensics from a neutral perspective. It is not linked to specific legislation or intended to promote a specific home business or product and is not written in bias of either law enforcement or commercial pc forensics. It is aimed at a non-technical audience and gives a high-level view of computer forensics. This guide utilizes the term "laptop or computer", but the suggestions apply to any device capable of storing digital data. Where methodologies have been mentioned they're offered as examples only and do not constitute strategies or assistance. Copying and publishing the entire or portion of this post is licensed solely under the terms of the Creative Commons - Attribution Non-Commercial 0 license

Uses of laptop or computer forensics There are couple of areas of crime or dispute exactly where personal computer forensics cannot be utilised. Law enforcement agencies have been amongst the earliest and heaviest users of personal computer forensics and as a result have continually been in the forefront of developments in the field. Computers may constitute a 'scene of a crime', as an example with hacking [ 1] or denial of service attacks or they might hold evidence at the kind of emails, internet history, documents or other files relevant to crimes such as murder, kidnap, fraud and drug trafficking. It is just not merely the content of emails, documents and other files which could be of interest to investigators then again at the same time the 'meta-information' related with those files. A laptop or computer forensic examination may perhaps reveal once a document initial appeared on a personal computer, once it was last edited, once it was last saved or printed and which user completed these actions.

Guidelines For evidence to be admissible it ought to be dependable and not prejudicial, meaning that at all stages of this process admissibility should be in the forefront of a laptop or computer forensic examiner's mind. One set of suggestions which has been widely accepted to help in this could be the Association of Chief Police Officers Good Practice Guide for Computer Based Electronic Evidence or ACPO Guide for short. Although the ACPO Guide is aimed at United Kingdom law enforcement its major principles are applicable to all personal computer forensics in whatever legislature. The 4 key principles from this guide have been reproduced under (with references to law enforcement removed):

No action have to alter data held on a computer system or storage media which might be therefore relied upon in court.

In cases exactly where a person finds it vital to access original data held on a computer or storage media, that individual need to be competent to do so and have the ability to offer you evidence explaining the relevance along with the implications of their actions.