Computer investigations
Computer investigations are also called computer forensics. This process deals with collecting, preserving, and producing the evidence that pertains to computer crimes. Evidence must be handled to ensure it is admissible in a court of law.
Evidence in computer investigations is a piece of information that supports a conclusion. From the legal perspective, evidence maybe oral or written statements, physical objects, computer files, computer data, or other documentary material that is admissible in a court of law.
Most of the evidence pertaining to computer crimes is intangible in nature. It maybe stored in a magnetic medium, such as tape, disk drive, or in memory. Information such as location, time, discovery, securing, controlling, and the maintenance of the evidence needs to be followed. This activity is called chain of evidence.
The cycle of activities from discovery of evidence to preservation, transportation, admission in the court, and to return to the owner...
