Computer Tools And The Forensic Examination
Michael P. Sheetz · 2012
This chapter discusses some of the tools that computer forensic investigators use in the context of a particular computer forensic examination. Many of these tools were developed specifically for use by computer forensic investigators. Others were developed for other areas of computer security and have, over time, been modified to serve the unique needs of forensic investigators. Still others have been developed for consumer use, and have been adapted over time to serve the needs of forensic investigators. Understanding the background of the case can make the job of investigators more focused. This phase of the assessment requires investigators to function more like traditional detectives. Exploring questions about things such as the nature of the offense, the skill level of the offender, and the sophistication of the computer installation may help narrow the scope of search and might even suggest new search methodologies .The chapter presents step-by step process that computer forensic examiners go through when pursing an examination. It rarely matters whether examiners are looking for evidence to use in a criminal prosecution or a civil law-suit.