Forensics
Computer Forensics is a branch of digital forensics that involves the recovery, analysis and documentation of data (including deleted ones) present in computers, hard drives and other digital storage devices. The data must therefore be processed in a manner that is fully compliant with computer forensic procedures. The final documentation of the data acquired and analyzed must also comply with the guidelines of forensic information technology. It is therefore configured in a file including the operations carried out during the investigations and details on the information obtained. Digital forensics was originally used as a synonym for computer forensics, but has expanded to cover investigations on all devices that store digital data. As society increases its dependence on information systems and cloud computing, digital forensics becomes a crucial aspect of law enforcement and businesses. Specifically, digital forensics is not synonymous with computer forensics as the former covers the entire category of devices while the latter is specific to PCs and storage media. More in detail, the areas of digital forensics are:
- Computer forensics, or disk forensics, which deals with the processing of computers, laptops, hard disks, pendrives, DVDs, CDs etc.
- Image forensics which deals with improving the quality of images and videos in order to extract information from them
- Mobile forensics that deals with forensic analysis of smartphones, tablets, mobile phones and any other mobile device
- Embedded forensics that deals with “non-traditional” devices such as anti-theft devices
- Metwork forensics that deals with analyzing and intercepting telematic traffic and correlating events on different systems connected to the network
- Vehicle forensics for the forensic analysis of vehicles
In general, regardless of the specific area, the phases of digital data processing in the context of digital forensics are:
Individuation
Acquisition analysis and evaluation
Collection
Presentation
Obviously these procedures correspond to the international standards of Computer Forensics. Of course, the execution of these technical activities requires the availability of an adequate computer forensic laboratory with all the software and hardware instruments necessary for the purpose.
Computer Forensics experts are able to recover all the data from the devices, thanks to in-depth analysis. Even deleted, fragmented and even temporary data can be recovered. Computer Forensics helps companies recover data lost due to a cyber raid (very common in cases of industrial espionage) and prove the existence of the crime.
