ASM: Allan Watt discusses how to handle computer evidence with care!
27 May, 2010
In today's world it is possible to track the actions of people through electronic records, which can be extracted by computer forensics, or e.forensics, investigations to provide valuable evidence.
E.forensics experts are trained to ensure evidence is handled correctly and not altered in any way. The process of collecting e.forensic evidence is not limited to computers; servers, mobile phones, cameras, and any item capable of holding digital information can be the subject of an e.forensic investigation.
If there were a robbery at a workplace, police not security would be called to investigate. As the preservation of evidence can be critical in any investigation, security may freeze the scene after the incident.
Electronic devices need to be handled in the same manner. If a company believe an incident has occurred involving an electronic device, IT staff may be able to investigate in some cases, but for the most part, they are not specifically trained in collecting and preserving electronic evidence to the standard which will be required should the matter go to court. Simply starting up a computer can alter up to 500 files alone, potentially contaminating evidence of wrongdoing.
Eforensics teams and departments are becoming more common in Australia, particularly with police forces, government organisations and large accountancy firms.
ASM: Allan Watt discusses how to handle computer evidence with care (1.11MB)
Back to Listing