There is a growing trend in investigation and litigation support called “electronic discovery.” Computer forensics is essential because the information needed to build a case increasingly resides in computer systems. More information is retained on a computer than most people realize. It is also complicated to remove information generally thought to have been deleted altogether.
For many reasons, computer forensics can often find evidence of, or completely recover, lost or deleted information, even if it was intentionally deleted. To effectively obtain this type of information, one cannot simply start the computer and search. Investigators need to consider issues such as spoliation, preservation of evidence, and admissibility as they discover the facts.