The field of computer forensics was created principally by law enforcement personnel for investigating drug and financial crimes. It employs rigorous protocols to collect information and facts contained on a broad selection of electronic gadgets, applying forensic processes to find deleted files and concealed information and facts.
Computer forensics projects involve capturing all the information and facts contained on a exact electronic system by applying both a forensic duplicate process or by doing an picture of all or a portion of the system. A forensic duplicate presents an specific duplicate of the difficult drive or storage system. None of the metadata, as well as the very last accessed date,is modified from the original. Nonetheless, the duplicate is a liveversion, so accessing the info on the duplicate, even only to see what is there,can transform this delicate metadata.