Definition of Computer Forensics Expert

Computer forensic specialists can often recover data from seemingly destroyed hard drives.

As electronic devices have become more advanced and more widely available, they have become more integrated into our everyday life. Because of this greater reliance, computers, cell phones and even digital cameras will often hold large chunks of important personal information. This information can prove vital in the prosecution of lawsuits. Locating and recovering that data is the job of a computer forensic specialist

Job Description

Computer forensics is the practice of investigating and retrieving available, deleted or hidden data on computer media, such as hard drives or the portable memory storage found in digital cameras and cell phones. Computer forensics is carried out by a suitably qualified specialist, and is often used in the collection of data for use as evidence in legal cases. The same techniques can also be used to retrieve lost or accidentally deleted information and data from corrupted or damaged storage media, for private individuals or businesses.

Law Enforcement

Law enforcement agencies and lawyers often use computer forensic specialists to locate potential evidence on computers allegedly have been used in criminal activity. According to the Commonwealth of Virginia Joint Commission on Technology and Science, the FBI created the first law enforcement computer forensic program in 1984. The FBI Magnetic Media Program, as it was initially called, performed examinations in just three cases in its first year.

Civilian Uses

A catastrophic hard-drive crash or physical malfunction on your business or home computer can mean the loss of valuable data, often beyond the recovery capabilities of even advanced computer users. The same techniques used in the recovery of data by computer forensic experts in law enforcement can also be applied to recover data that would seemingly be lost beyond all hopes of retrieval.

Recovery Process

Computer forensic specialists recover data by utilizing their forensic training in conjunction with specialized software and tools. Processes for recovering data vary depending on the specific problem but the chances of recovering data from severely damaged hard drives is far higher than most people expect, according to a report conducted in 2009 by the International Journal of Security. “Data contained on a disk that has been physically cut into pieces has been successfully recovered,” the report stated.

Training

Training to become a specialist in the field of computer forensics is available through many colleges and universities. Courses vary with each educational facility and can be carried out either via distance learning or residential courses. Qualifications also differ with each training provider and can range from simple certifications as a qualified forensic examiner to full four-year degree programs.

References

• Regional Computer Forensic Laboratory: Computer/Digital Evidence History
• International Journal of Security: Techniques in Computer Forensics-A Recovery Perspective