BUS 082 Lecture Notes - Lecture 16: Computer Forensics

• School: College of The Sequoias
• Department: Business (BUS)
• Course: BUS 082
• Professor: Cordero

Document Summary

These tools can also be used to analyse data to look for these type of issues by using sql queries and reporting functions, where" statements etc. Preservation, identification, extraction and documentation of computer evidence. Can involve recovering information the naked eye can no longer see. Involves: acquisition of information, authentication of information, analysis of evidence, documentation, expert report on computer evidence, report may form part of court case. Computer forensics is one piece of a forensic investigation. This is used where evidence needs to be collected from electronic sources and is not readily available for forensic analysis. Organisations must have proper authorisation to be conducting this type of analysis on a computer. Must consider privacy laws before conducting a search of a computer and often get legal advice. Often computer forensics information can be pieced together from recovered files, internet cache and slack space on the computer: you may look at what was deleted as a starting point.