This chapter provides an overview of the important concepts associated with computer forensics. It describes the potential sources of evidence available in the typical computer, whether it is a desktop, a laptop, a handheld device, or a hybrid; how to conduct a search for evidence; and a method of conducting a search in a systematic and effective manner. Many criminals who are highly computer literate remain unaware of the amount of information that is stored on the computer (including their own computer), and the many software tools and utilities available that allow evidence to be recovered from various types of storage media, including hard drives and random access memory. Therefore, every investigation of a crime or of unauthorized activity should now be based on the assumption that some effort will be invested in examining computers and computer records to locate relevant evidence that will prove or disprove allegations or suspicions of wrongdoing.
[“source=sciencedirect”]