Computer sleuth - the inside job
The chilled room and thin rubber gloves clutching what could be a surgical instrument hint at a more medical version of forensics. But the corpse being dissected in the air-conditioned forensics lab at financial intelligence specialists McCallum Petterson is a laptop - and its exposed innards are potentially a mine of damning evidence.
In our digital work environment, a company or employee indulging in illegal or immoral activity is likely to have left a few electronic footprints. And it's a trail not easily erased.
Deleting computer files only removes them from view, says company IT forensics specialist Daniel Ayers, it doesn't destroy them.
"If you analyse the hard disc, you can retrieve deleted files dating back years. Most people don't know that. They don't realise they are leaving tracks."
Computers, cellphones, global positioning systems or other electronic devices all have their stories to tell when interrogated by an IT forensics expert.
[ Read more ]
- Review: Computer Forensics: Incident Response Essentials (18 August 2002)