digital digital known digital forensic science branch forensic science encompassing recovery investigation material found digital devices relation computer crime term digital originally synonym computer expanded cover investigation devices capable storing digital data roots personal computing revolution late 1970s early 1980s discipline evolved manner 1990s early 21st century national policies emerged digital investigations variety applications common support hypothesis criminal civil electronic discovery process courts feature private sector internal corporate investigations intrusion investigation specialist probe nature extent unauthorized network intrusion technical aspect investigation divided sub branches relating type digital devices involved computer network forensic data analysis mobile device typical forensic process encompasses seizure forensic imaging acquisition analysis digital media production report collected evidence identifying direct evidence crime digital attribute evidence specific suspects confirm statements determine intent identify sources example copyright cases documents investigations broader scope areas forensic analysis usual aim provide answers series simpler questions involving complex time lines history prior 1980s crimes involving computers dealt existing laws computer crimes recognized included legislation unauthorized modification data computer system years range computer crimes committed increased laws passed deal issues copyright privacy harassment bullying stalking online predators child pornography 1980s federal laws began incorporate computer offences canada country pass legislation followed australian amendments crimes acts british computer act 1980s 1990s growth field growth computer crime 1980s 1990s caused law enforcement agencies begin establishing specialized groups usually national level handle technical aspects investigations example fbi launched computer analysis following year computer crime department set fraud squad law enforcement professionals early members groups computer responsible field initial research direction practical publicized examples digital pursuit investigation use computer network forensic techniques specialized earliest forensic examinations followed profile 1990s high demand new basic investigative resources strain central units lead creation regional local level groups help handle load example set provide national infrastructure computer crime personnel located centrally london regional police forces unit folded period science digital grew hoc tools techniques developed practitioners contrast disciplines developed work scientific community term computer academic literature prior informal use paper attempted justify new discipline forensic science world swift development resulted lack training book high technology crime investigating cases involving computers wrote seizing preserving analyzing evidence stored computer greatest forensic challenge facing law enforcement 1990s forensic tests dna testing performed specially trained experts task collecting analyzing computer evidence assigned patrol officers detectives 2000s developing standards response need bodies agencies published guidelines digital digital evidence produced paper best practices followed publication standard general requirements testing laboratories european lead international treaty came force aim national computer crime laws investigative techniques international operation treaty signed nations including canada japan south_africa european nations ratified issue training received attention commercial companies forensic software developers began offer certification programs digital forensic analysis included topic specialist investigator training facility late 1990s mobile devices widely available advancing simple communication devices found rich forms information crime traditionally associated digital despite digital analysis phones traditional computer media largely problems nature devices focus shifted internet crime particularly risk warfare february report concluded enemies target industry government military air land maritime space domains way transformed battlefield world war fractured physical barriers shield nation attacks commerce communication field digital faces unresolved issues paper bad identified bias windows operating systems digital research identified issues facing digital investigations future including increasing size digital media wide availability consumers growing variety operating systems file formats increasing number individuals owning multiple devices legal limitations investigators paper identified continued training issues high cost entering field development forensic tools 1980s specialized digital forensic tools existed consequently investigators performed live analysis media examining computers operating system existing tools extract evidence practice carried risk modifying data disk inadvertently led claims evidence number tools created early 1990s address problem need software recognized resulting creation developed similar software developed countries hardware software solution released commercially released fixed disk image free australian law enforcement tools allowed create exact copy piece digital media work leaving original disk intact end 1990s demand digital evidence grew advanced commercial tools developed allowing analysts examine copies media live recently trend live memory grown resulting availability tools recently progression tool development occurred mobile devices initially investigators accessed data directly device soon specialist tools appeared forensic process digital forensic investigation commonly consists stages acquisition imaging exhibits analysis reporting acquisition involves capturing image computer volatile memory ram creating exact sector level duplicate forensic duplicate media write blocking device prevent modification original growth size storage media developments cloud computing led use live acquisitions logical copy data acquired complete image physical storage device acquired image logical copy original media data values compared verify copy accurate analysis phase investigator recovers evidence material number different tools article referred step depth systematic search evidence related suspected crime researcher described intuitive procedure obvious evidence identified searches conducted start filling holes actual process analysis vary investigations common include conducting searches digital media files space recovering deleted files extraction registry information example list user accounts attached devices evidence recovered analysed reconstruct events actions reach conclusions work performed specialised staff investigation complete data presented usually form written report lay persons terms application digital commonly criminal law private investigation traditionally associated criminal law evidence collected support oppose hypothesis courts areas wider investigation spanning number disciplines cases collected evidence form intelligence gathering purposes court proceedings example locate identify halt crimes result intelligence gathering held strict forensic standard civil litigation corporate matters digital forms electronic discovery process forensic procedures similar criminal investigations different legal requirements limitations outside courts digital form internal corporate investigations common example following unauthorized network intrusion specialist forensic examination nature extent attack performed damage limitation exercise establish extent intrusion attempt identify attacker attacks commonly conducted phone lines 1980s modern era usually propagated internet main focus digital investigations recover objective evidence criminal activity termed legal diverse range data held digital devices help areas inquiry data logs attribute actions individual example personal documents computer drive identify owner statements information provided involved cross checked digital evidence example investigation murders mobile phone records person claimed showed town time intent finding objective evidence crime committed investigations prove intent known legal term example internet history convicted killer included references site discussing kill people evaluation source file artifacts data identify origin particular piece data example older versions embedded files identified computer created proving file produced digital device examined obtained internet important document related evaluation source data associated digital documents easily modified example changing computer clock affect creation date file document relates detecting identifying details limitations major limitation forensic investigation use initial examination evidence located laws individuals disclose keys relatively new controversial legal considerations examination digital media covered national international legislation civil investigations particular laws restrict abilities analysts undertake examinations restrictions network monitoring reading personal communications exist criminal investigation national laws restrict information seized example united_kingdom seizure evidence law enforcement governed pace act existence early field agency worked establish compatible international standards seizure evidence laws covering computer crime affect forensic investigators computer act access computer material particular concern civil investigators limitations law enforcement individuals right privacy area digital largely courts places limitations ability law enforcement civil investigators intercept access evidence act makes distinction stored communication email archives transmitted communication considered privacy invasion harder obtain warrant affects ability companies investigate computers communications employees aspect debate extent company perform monitoring article european convention human rights asserts similar privacy limitations limits processing sharing personal data external countries ability law enforcement conduct digital investigations powers act digital evidence court law digital evidence falls legal guidelines forms evidence courts usually require stringent guidelines united_states evaluate digital evidence united_kingdom pace acts similar guidelines countries laws federal laws restrict items obvious value acknowledged possible establish digital media prior examination laws dealing digital evidence concerned issues integrity authenticity integrity ensuring act seizing acquiring digital media modify evidence original copy authenticity refers ability confirm integrity information example media matches original evidence ease digital media modified means documenting chain custody crime scene analysis ultimately court form trail important establish authenticity evidence attorneys argued digital evidence theoretically altered reliability evidence judges beginning reject theory case court ruled fact possible alter data contained computer insufficient establish united_kingdom guidelines issued followed help document authenticity integrity evidence digital investigators particularly criminal investigations ensure conclusions based factual evidence expert knowledge example state qualified expert testify form opinion long testimony based sufficient facts data testimony product reliable principles methods witness applied principles methods reliably facts case sub branches digital specific guidelines conduct investigations handling evidence example mobile phones required placed shield seizure acquisition prevent radio traffic device forensic examination computers criminal matters subject guidelines international approaches providing guidance handle electronic evidence offers framework law enforcement judicial authorities countries seek set enhance guidelines identification handling electronic evidence investigative tools digital evidence relies tools extract forensic tools subjected standard judge responsible ensuring processes software acceptable paper argued guidelines required code forensic tools published peer reviewed concluded open source tools clearly meet requirements closed source tools branches digital includes sub branches relating investigation types devices media artifacts computer goal computer explain current state digital artifact computer system storage medium electronic document discipline usually covers computers embedded systems digital devices rudimentary computing power onboard memory static memory pen drives computer deal broad range information logs internet history actual files drive prosecutors recovered computer secure death penalty killer identified email messages detailing torture death fantasies found computer mobile device mobile device sub branch digital relating recovery digital evidence data mobile device differs computer mobile device communication system usually storage mechanisms investigations usually focus simple data data communications sms email depth recovery deleted data sms data mobile device investigation helped murder mobile devices useful providing location information gps location tracking cell site logs track devices range information track network network concerned monitoring analysis computer network traffic local internet purposes information gathering evidence collection intrusion detection traffic usually intercepted level stored later analysis filtered real time unlike areas digital network data volatile rarely logged making discipline fbi lured computer united_states fake job interview monitoring network traffic pair computers fbi identified allowing collect evidence directly russian based computers forensic data analysis branch digital examines structured data aim discover patterns fraudulent activities resulting financial crime database database branch digital relating forensic study investigations use database contents log files ram data build timeline recover relevant information education research academic centre education research forensic sciences north_america offers security risk analysis major digital area related journals security digital evidence international journal forensic computer science journal scale digital device forensic journal
Digital forensics