Computer Forensics

 Computer Forensics (sometimes computer forensic science) is a branch of digital forensic science pertaining to legal evidence found in computers and digital storage media.The goal of computer forensics is to explain the current state of a digital artifact such as a computer system, storage medium (e.g. hard disk or CD ROM), an electronic document (e.g. an email message or JPEG image). The scope of a forensic analysis can vary from simple information retrieval to reconstructing a series of events.
     Technicians may gather or process evidence at crime scenes, in the field of digital forensics training is needed on the correct handling of technology (for example to preserve the evidence). Technicians may be required to carry out "Live analysis" of evidence - various tools to simplify this procedure have been produced, most notably Microsoft's COFFEE . Sometimes technicians also conduct the acquisition/imaging stage of the process.

HTTP LINKShttp://www.us-cert.gov/reading_room/forensics.pdf