A Practical Guide to Computer Forensics Investigations

Introduction

The field of digital forensics is relatively new, and more books are being published on this subject matter in recent times. The problem is that many of books are very technical but are lacking in terms of the investigative skills. To be an exemplary computer forensics examiner, you need to have both technical and investigative skills. For example, simply finding the evidence on a computer is not good enough—you must be able to place the suspect behind the keyboard. Moreover, a good investigator must be able to think well beyond the scope of the computer. Chapter 11, “Mobile Forensics,” is a good example of this: an investigator can retrieve an extraordinary amount of evidence about a user’s activity on a smartphone without actually ...