Computers expert witness Scott Greene of Great Scott Enterprises, Inc., writes that it is important to understand that computer forensics is not just “looking around in a computer.”
There are very specific protocols for recovering, preserving and analyzing the data as evidence. Certain data may need to be recovered due to the fact that it was purposely destroyed. In addition, there are data files that are created during normal operation of the operating system or of an application program that individuals usually don’t realize exist. These intricacies require an expert. Proper handling techniques preserves data from websites, computer files, fax machines, emails, etc.
Did you know that computer forensic analysis can reveal:
What web sites have been visited?
What files were been downloaded?
File creation, access and modification dates?
Attempts to conceal and destroy evidence or data?
Data fabricate attempts?
Original electronic documents can contain text that were removed from the printed version?
Excerpted from http://great-scott.com/index.html