Cyber Law

Decades ago, proving the guilt or innocence of someone who had been charged with a crime had to be accomplished without reviewing computer files. Today, forensic scientists regularly collect and review files hidden on computers. The data they find can be invaluable. For example, it can prove that a defendant was knowledgeable about criminal details and communicated them to another party. Or, such files can help prove that a victim was present at a certain location on a certain date. The science and discipline of computer forensics have been used to secure convictions in thousands of criminal cases. In this article, we'll explain the types of data that forensic scientists collect from computers and potential legal applications of computer forensics.

Types Of Data Collected

The easiest files to collect are those which are still saved on a hard drive. Forensic investigators are trained to look for these files in obscure locations or in directories with counterintuitive names.

Forensic experts also look for deleted files. Once a file has been created and saved on a hard drive, disposing of it can be problematic. If a file is deleted, it can usually be recovered. Contrary to what many believe, deleted files remain on a computer's hard drive; they're simply ignored. When needed, they can be collected easily.

There are other types of files that computer forensic personnel look for. For example, some files are saved in a temporary status. Computers often save them in addition to the original.

A file's metadata can also prove valuable to an investigation. The metadata contains information regarding usage of a file. It will include the date and time a file was updated along with its creation date and a time stamp of when the file was last opened. This metadata can be helpful for showing relevant knowledge or intent and can be presented as evidence.

Potential Legal Applications

There are a number of ways to employ computer forensics to collect valuable information for use during an investigation or civil and criminal court cases. For example, if someone is missing, a recent airline ticket purchase on that person's computer can lead authorities to the person. Or, emails and other incriminating documents that are found on a defendant's computer can be submitted as evidence that leads to a conviction. As another example, a spouse's documentation of hidden assets and bank accounts can be used during divorce proceedings. In each case, computer forensic investigators can collect and review files for possible submission as evidence in court.

Computer forensic detail is used in areas that expand beyond the courtroom. For example, employers monitor their employees' use of computers, possible collecting information before terminating a worker. Criminal investigators often use computers to search for clues on unsolved crimes. A person who dies may have seemingly done so without a will, though the will may actually exist on his computer's hard drive. Computer forensics will continue to yield valuable insight for use in court, in the workplace and for countless other applications.