Computer forensics integrates the fields of computer science and law to investigate crime. For digital evidence to be legally admissible in court, investigators must follow proper legal procedures when recovering and analyzing data from computer systems. Unfortunately, laws written before the era of computer forensics are often outdated and cannot adequately assess the techniques used in a computer system search. The inability of the law to keep pace with technological advancements may ultimately limit the use of computer forensics evidence in court.
Privacy advocates are growing especially concerned that computer searches may be a breach of a suspect’s human rights. Furthermore, as methods for encryption and anonymity grow more advanced, technology may be abused by helping criminals hide their actions. Ultimately, the role of technology in computer forensics may not reach its full potential due to legal boundaries and potential malicious intentions.
Forensic science is the scientific method of gathering and examining information about the past which is then used in a court of law. The word forensic comes from the Latin forēnsis, meaning “of or before the forum.” In Roman times, a criminal charge meant presenting the case before a group of public individuals in the forum. Both the person accused of the crime and the accuser would give speeches based on their sides of the story. The case would be decided in favor of the individual with the best argument and delivery. This origin is the source of the two modern usages of the word forensic – as a form of legal evidence and as a category of public presentation. In modern use, the term forensics in the place of forensic science can be considered correct, as the term forensic is effectively a synonym for legal or related to courts.
Forensic investigations seek to uncover, analyze and preserve evidence to be used in criminal proceedings. As technology has become increasingly prevalent in everyday life, investigations have spread to computers, telephones and other electronics.
Computer forensics has been indispensable in the conviction of many well-known criminals, including terrorists, sexual predators, and murderers. Terrorist organizations may use the Internet to recruit members, and sexual predators may use social networking sites to stalk potential victims. However, most criminals fail to cover their tracks when using technology to implement their crimes. They fail to realize that computer files and data remain on their hard drive even when deleted, allowing investigators to track their criminal activity. Even if criminals delete their incriminating files, the data remains in a binary format due to “data remanence” or the residual representation of data. File deletion merely renames the file and hides it from the user; the original file can still be recovered.