Computer forensics investigations involve the collection, preservation, analysis, and presentation of electronic evidence from computers so that it can be used in court. Digital evidence for use in litigation can be found by uncovering data trails from emails, document modification, and looking for data and files that have been copied or transferred to external devices such as thumb drives or external hard drives. Locating these data trails and identifying date and time stamps must be done in a forensically sound manner so that evidentiary status is maintained in the process. If proper processes and procedures are not followed, you run the risk of jeopardizing your case by disallowing your evidence. Do you need to know the exact actions taken by a user on a computer? It is entirely possible for other individuals inside or outside the organization to connect to a computer in an effort to perform rogue activities that will reflect negatively on the normal user of the computer. Obtaining the facts and an expert opinion regarding those facts can provide you the validation and confidence you need before taking action.
