Term Computer Forensics
Code FN-1300.1800-130
Definition Programs that conduct forensic examinations to recover data from computers and other digital devices (e.g., tablets, cell phones) seized as evidence in criminal investigations, examine and analyze the data and present their findings during discovery, depositions, court or administrative hearings or other legal proceedings. Items of interest include email messages transmitted via the Internet as well as data in deleted, encrypted, hidden, password-protected or damaged files. Forensic experts can be called upon to support cases involving data breaches, intrusions or other types of incidents; activities may include verification of alibis, examination of Internet abuse, misuse of computing resources and network usage in making computer-related threats. The ultimate goal is to identify the individual(s) responsible for the criminal activity and prepare forensic evidence for testimony, especially when the examiner will be called as an expert witness.
Created 8/9/18
Changed 8/9/18
Use References Cyber Crime Forensics
Cybercrime Forensics
Digital Forensics
Electronic Evidence Collection
See Also References Computer and Information Sciences Research (TR-6500.1500)
Cybersecurity Risk Assessment (TP-3350.3450-140)
Private Investigation Agencies (FV-6380)
External Classification Terms Law Enforcement (UW
Law Enforcement (NTE I60)
Law Enforcement Agencies (NPC I04)
Legal, Consumer and Public Safety Services (AIRS LE-450)
Legal/Public Safety (CAN LP-450)
Related Concepts
Facet Service
Bibliographic References "An Explanation of Computer Forensics by Judd Robbins", http://computerforensics.net/forensics.htm

"Computer Crime Investigation Using Forensic Tools and Technology", https://resources.infosecinstitute.com/computer-crime-investigation-using-forensic-tools-and-technology/#gre

Privacy Policy. Terms of Use. Contact 211 LA County.