More than 90% of today’s information is created
and stored or processed electronically.
More than 70% are never printed or produced
into a hard copy
Information can be erased, moved around, or
hidden with ease.
A good forensic examiner can restore or find this
Using computer science to aid
in the legal process and to
Gathering data for evidence
Aid police investigations
Provide testimony in court
Gather any other information
that can be found on a digital
or electronic media.
Information gathered can be
audio, video, or graphical.
Any other storage
When is digital forensics used?
What do they do?
Forensics experts extract both visible and invisible computer data.
More than simply data recovery:
Locate data throughout the system
Responsible for maintaining the integrity of the information found,
preventing damage, data corruption, or virus exposure. (All data must
be acceptable for use in a court of law.)
Results of forensic investigation must be reproducible in such a way
that the information is authenticated and reliable
Work closely with law enforcement, government officials, and
Must be well-versed in relevant case law.
A skilled forensic worker can
recover all of the files on a
computer or storage device.
Deleted but remaining files
Pass-word protected files
Most information that is
gathered is undetectable or
unviewable to the average
Digital forensic practitioners are generally
concerned with three types of data:
Active data: information that is readily available and
easily accessed on the computer. Ex: Programs,
files, and other data used by the operating system.
Archival data: data that has been backed up and
stored. Ex: hard disks, cd’s, USB drives
Latent or Ambient data: data that requires special
tools or skills to retrieve. Ex: data that has been
overwritten or deleted
Steps for Investigating an
All files that have been deleted or have not yet
been overwritten are recovered.
Computers constantly write data to the hard drive
when in use. The operating system over writes data
on the hard drive that is no longer needed or used.
This data can be retrieved if not completely
All data found in special
or inaccessible areas of
the device are analyzed.
Areas of disk that are not
currently in use, but have
had data previously stored
Slack Space- unused
space at end of file where
information could be stored
Report the analysis of the device or
Provide copies of data collected
Arranged into support for legal theories or
Often provide expert testimony or advice
Tools that analyze lighting
allow forensics practitioners to
determine if a photo has been
Microsoft Log Parser
Extract information of almost
Dumps memory contents of a
process into a file without
stopping the procedure
Famous Cases Solved with Digital
Last seen alive on April 23,
Digital forensics lead to the
discovery that someone had
conducted an internet search
for Rock Creek Park’s Klingle
Mansion, near Washington,
Police scoured the area and a
man walking his dog found
Levy’s remains on May 22,
2002, approximately one year
later, confirming that the case
was in fact a homicide.
Known as BTK killer in Wichita,
Murdered 10 people between
1974 and 1991.
Communicated with police
through letters for years. Sent a
message on a floppy disk in
Examination of the disk’s
properties revealed the words
“Dennis” and “Christ Lutheran
DNA tests confirmed him a match
and he was arrested 9 days later.
Rader was planning his first
murder since 1991.
Digital forensics is a very high tech field
Can be expensive
Has immense potential in law
enforcement, and especially in the future
of law enforcement.
Field grows in leaps and bounds every