Computer Forensics involves the identification, documentation, and interpretation of computer media for using them as evidence and/or to rebuild the crime scene.
It deals with the application of investigative analysis techniques on computers to retrieve and preserve evidence in a legally admissible way.
Computer forensics branched into several areas:
Figure 1 Types of Computer Forensic
The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computing device and who was responsible for it.
There is a standard set of procedures that need to be followed by a forensic investigator while conducting cases.
All of the evidence used should be isolated physically so that it cannot be contaminated and in other words, the forensic investigators have to always make copies of the evidence.
Also, there are hundreds of techniques and software used that are related to computer forensics in order to solve the crimes.
Guidelines on Computer Forensics Investigation 