Dave

Computer Forensics -- The simple definition of Computer Forensics, "... is the use of specialized techniques for recovery, authentication, and analysis of electronic data when a case involves issues relating to reconstruction of computer usage, examination of residual data, authentication of data by technical analysis or explanation of technical features of data and computer usage.

Computer forensics requires specialized expertise that goes beyond normal data collection and preservation techniques available to end-users or system support personnel." This process often involves investigating computer systems to determine whether they are or have been used for illegal or unauthorized activities. Mostly, computer forensics experts investigate data storage devices, either fixed like hard disks or removable like compact disks and solid state devices.