Forensic Computing and Its Field of Activity
Some crimes committed in real life, such as fraud, theft, tampering with evidence, and deceit, can also be committed in the virtual world in different ways. Forensic computing begins here, working in areas such as finding the criminals who committed these crimes, accessing and uncovering evidence of the crime. Throughout the meticulously conducted forensic computing process, all work must be carried out carefully, and evidence that is attempted to be erased must be accessed. Based on this evidence, criminals are identified, and necessary punishments are ensured. To conduct the necessary examinations, an investigation begins on electronic devices seized with a court order, along with the research topics specified by the prosecutor's office.
Forensic Computing Examination Process
There are 4 basic methods in Forensic Computing Examination. These are;
Identification: In this process, potential data storage sources to be examined are identified and collected. These data sources can be listed as computers, hard disks, CDs, DVDs, USB drives, and memory cards.
Examination: After obtaining identical copies of the data sources obtained in the identification phase, all related research is conducted on these copies. Ensuring the integrity and protection of the examined evidence is essential. Working with a copy of the evidence rather than the original evidence is healthier and will not cause any loss or damage to the original evidence, so the work should be done on the copy.
Analysis: In this phase, data related to the subject is uncovered from the copy of the examined evidence.
Reporting: This is the stage where the presentation of the information reached in the analysis phase is prepared and delivered. Reporting should be prepared with clarity and language that can be understood by the readers of the report and should include the evidence obtained.
