System Forensics, Investigation, and Response, 3rd Edition

Understanding the Field of Digital Forensics

The field of digital forensics is changing very rapidly. First and foremost, standards are emerging. This means there are clearly defined ways of properly doing forensics. When computer forensics first began, most investigations were conducted according to the whim of the investigator rather than through a standardized methodology. But as the field has matured, it has also standardized. Today, there are clear, codified methods for conducting a forensic examination.

Another change is in who is doing forensics. At one time, all forensics, including computer forensics, was the exclusive domain of law enforcement. That is no longer the case. Today, the following entities are also involved in and actively ...