COMPUTER FORENSICS IS the scientific process of collecting and examining data stored on, received from, or transmitted by an electronic device. It is a demanding area of study. New technologies that store data are created every day. People who choose to work in this area must constantly study these new technologies. They must learn how to collect and examine data from devices that use the new technology. Computer forensics is also a rapidly expanding profession. The U.S. Department of Labor estimates higher-than-average job growth for people in this career.¹

This chapter introduces basic concepts about computer forensics. It also discusses the role of the computer forensic examiner. Finally, it reviews legal issues surrounding how digital evidence is gathered and used.