Forensic computing, also called forensic computing, forensic computing, digital forensic analysis or digital forensic examination, is the application of specialized scientific and analytical techniques to technological infrastructure that allow identifying, preserving, analyzing and presenting data that are valid within a legal process.
These techniques include reconstructing the computer asset, examining residual data, authenticating data and explaining the technical characteristics of the use applied to data and computer goods.
As the previous definition indicates, this discipline makes use not only of cutting-edge technologies to be able to maintain the integrity of the data and their processing; It also requires a specialization and advanced knowledge in computer science and systems to be able to detect what has happened inside any electronic device. The forensic informant's knowledge covers the knowledge not only of the software but also of hardware, networks, security, hacking, cracking and retrieval of information.
Computer forensics helps detect clues about computer attacks, information theft, conversations or email and chat tracks.
The importance of these and being able to maintain their integrity is based on the fact that digital or electronic evidence is extremely fragile. The simple fact of double clicking on a file would modify the last access date of it.
Additionally, a digital forensic examiner, within the forensic computation process, may recover information that has been deleted from the operating system. The computer forensic specialist must keep in mind the Locard exchange principle as well as the Daubert standard, due to its importance in the analysis of criminology and the admissibility of evidence that a forensic expert must present as testimony in a trial, respectively.
It is very important to mention that forensic computing or forensic computing does not have a preventive part, that is to say, forensic computing does not aim to prevent crimes, this is the responsibility of computer security, so it is essential to be clear about the framework of action between computer forensics, computer security and computer audit.