There is a growing trend in investigation and litigation support called “electronic discovery.” Computer forensics is essential because the information needed to build a case increasingly resides in computer systems. More information is retained on a computer than most people realize. It is also complicated to remove information generally thought to have been deleted altogether.
For many reasons, computer forensics can often find evidence of, or completely recover, lost or deleted information, even if it was intentionally deleted. To effectively obtain this type of information, one cannot simply start the computer and search. Investigators need to consider issues such as spoliation, preservation of evidence, and admissibility as they discover the facts.

Commercial organizations have used computer forensics to their benefit in a variety of cases such as:

  • Intellectual Property theft
  • Industrial espionage
  • Employment disputes
  • Fraud investigations
  • Forgeries
  • Bankruptcy investigations
  • Inappropriate email and internet use in the work place
  • Regulatory compliance