Computer forensics is an emerging discipline that focuses on the gathering of evidence (often as part of a criminal investigation) from computers and computer networks. Such evidence may consist of actual files (e.g. an illegal image) or the traces of a user's activities that are left in the activity logs of operating systems, browsers, databases, web proxies, or network firewalls, etc. The discipline requires a detailed technical knowledge of the relationship between a computer's operating system and the supporting hardware (e.g. hard disks), and between the operating system and system/application programs and the network. Similarly, knowledge of cryptographic and steganographic techniques is needed where data has been encrypted and/or obfuscated to make it inaccessible and/or hidden. Finally, and critically, all evidence gathering must proceed in a manner that ensures that the evidence is admissible in a court of law, and can be documented and presented in an intelligible manner.

To quote Sir Arthur Conan Doyle, author of famous Sherlock Holmes stories published between 1887 and 1927: "in solving a problem of this sort, the grand thing is to be able to reason backwards. That is a very useful accomplishment, and a very easy one, but people do not practise it much. In the everyday affairs of life it is more useful to reason forward, and so the other comes to be neglected. There are fifty who can reason synthetically for one who can reason analytically."

There are many possibilities of where the hidden information of a hard drive can be retrieved. One of these locations are hidden log files and deleted files. Using special computer forensics software, a formatted hard drive may still be able to be recovered with all of information inside. In the event of advanced network system, there are many important information inside firewalls logs, switches logs, intrusion detection systems logs, security event managers, sniffer captured packets, routers logs, etc. Collecting information from these kinds of data sources and combining them into useful information can be state-of-the-arts of the computer forensics investigators. Steganography for computer forensics can hide information inside carriers like picture, audio, video, etc. Steganography comes from the word "steganos" (hidden) and "graphy" (drawing). It means a communication using a hidden drawing.

Western Digital Hard Drive

Kruse and Heiser note that “Computer forensics involves the preservation, identification, extraction, documentation and interpretation of computer data.” [from "Computer Forensics: Incident Response Essentials", see Books And Journals page]. In summary, and paraphrasing McKemmish in his report to the Australian Institute of Criminology, computer forensics encompasses four key elements: the identification of digital evidence, the preservation of digital evidence, the analysis of digital evidence, and the presentation of digital evidence.

To clarify a few common misconceptions: first, computer forensics is not the use of computers within forensic science. Such use is made up of all those activities where forensic scientists employ computers to assist them in their work. Such tasks include: the processing and analysis of traditional forensic data be it physical, chemical, or biological in nature; the use of computers to support forensic databases; and the use of computers to cross-reference different sources of forensic evidence. Proper term to descibe them is "forensic computing". These are all worthy tasks but are not the focus of this major. Second, though computer forensics is often related to computer security it is none the less distinct. It is quite possible for criminal activity (in the eyes of the law) to require forensic analysis without there having been any breach of traditional computer security. Finally, it is worth noting that a number of synonyms for computer forensics exist, sometimes used incorrectly; these include "forensic computing", "digital forensics", and even "data recovery" in some circles.

See Online Materials section: "Publications About Computer Forensics, General" for more.