What Is Computer Forensics?

What you'll be able to do

By the end of this lesson you will be able to explain what computer forensics is, what it is for, and the basic steps every investigation follows.

• Define computer forensics and name its other common names.
• Describe its three basic steps: data collection, analysis and presentation.
• Give examples of how forensics is used beyond criminal cases, including data recovery and investigating failures.

A Working Definition

Dr. Al-Doori opens the book with a clear definition: computer forensics is the investigation of a computer or other device to gather and present digital evidence in a court of law. You will also hear it called digital forensics or cyber forensics; the three names are used almost interchangeably. The goal is to carry out an investigation and document a chain of evidence that shows what happened to the device and who was responsible.

Two parts of that definition deserve attention.

• "Or other device." Forensics is not only about desktop computers. Phones, tablets, USB sticks, servers, game consoles, cars and cloud accounts all hold data that can become evidence.
• "In a court of law." Forensic work is done to a standard that would survive scrutiny in court, even when a case never reaches one. That standard is what separates forensics from simply "having a look" at a computer.

NIST, the US standards body, offers a definition that you will see quoted widely: digital forensics is "the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data." Notice the words science, integrity and chain of custody. They will come up in almost every lesson.

The Three Basic Steps

The book explains that computer forensics procedures generally follow three steps.

1. Data collection. Examiners make an exact digital copy of the data, called a forensic image, and keep the original locked away so that its condition is preserved. All further work happens on the copy.
2. Analysis. Investigators use specialist tools to examine the copy carefully and gather the information relevant to the case.
3. Presentation. Investigators present what they found, usually in a written report and sometimes as testimony to a judge or jury.

In Lesson 1.4 you will see the book expand these into four stages (acquire, preserve, analyze and report) once it looks at a crime scene in detail. The idea is the same: copy carefully, protect what you copied, examine it, and explain it honestly.

Why We Use Computer Forensics

Modern technology records an enormous amount of data around the clock, much of it without the user knowing. The book's example is the car: modern vehicles continually record when a driver brakes, changes gear and changes speed. Phones log locations, photos carry hidden details about when and where they were taken, and computers keep records of what was opened and when. NIST's 2022 review of digital investigation techniques makes the same point: in routine operations, computers store much more data than they show the user.

That data can be critical in a legal matter or a crime, and forensics is how it is found and preserved properly. But the book stresses uses beyond court cases:

• Data recovery. The forensic process can recover data from a crashed server, a failed drive or a reformatted system.
• Finding the cause of a failure. When a system stops unexpectedly, forensic methods can show what went wrong, and whether a compromise was involved.
• Business resilience. Organizations recovering from a disaster use forensic experts and processes. Good data management and security practices make any later investigation much easier.

Real-World Example

Imagine (a fictional scenario) a small online retailer whose order server crashes at 2:14 a.m. on a Saturday. By Monday the site is back up, but the owners want to know why it failed. Was it a faulty disk, a bad update or an attacker?

A forensic examiner follows the three steps. Collection: before anyone "fixes" anything else, they image the server's disk and record a hash value that proves the copy is exact. Analysis: on the copy, they examine the system logs and find a failed software update at 2:11 a.m. that filled the disk until the database stopped. There are no signs of unauthorized access. Presentation: they write a short report with a timeline, the evidence for each entry and a clear statement of what the evidence does not show. The owners now know to fix their update process rather than spend money on a security investigation they do not need. No court was involved, but the same careful method made the answer trustworthy.

From the Book to 2026

What the book teaches. Computer forensics investigates a computer or other device to gather and present evidence in court, in three steps: collection, analysis and presentation.

Why it made sense. It is a clear, durable description of the work, and it puts the emphasis on evidence that can stand up in court.

What has changed. The definition holds; the range of "other devices" has widened enormously. Most web traffic now comes from phones and tablets, much of their data lives in cloud services rather than on any device in front of the investigator, and cars, watches and home devices record data too. NIST's guidance describes the process in four phases: collection, examination, analysis and reporting. This is the same idea as the book's steps, with examination (extracting the relevant data from everything collected) separated from analysis (working out what it means).

What to do now. Read "computer forensics" as "digital forensics": the same principles apply to every device and service that stores data. When you plan an investigation, ask early where the data actually lives: on the device, in the cloud, or both.

Watch: Introduction to Digital Forensics

This video is the first lesson of a free introductory digital forensics course by DFIRScience, a channel run by a digital forensics academic. It is written for people with no background in the subject.

Questions to keep in mind as you watch:

• How does the presenter's description of digital forensics compare with the book's definition and with NIST's?
• Which kinds of devices and data are mentioned beyond the traditional desktop computer?
• Where do you see the three steps of collection, analysis and presentation?

The video complements what you just read. The lesson is complete without it.

What Would You Do?

Your company's file server stopped working overnight. Your manager says: "Just restart it, reinstall what's broken and get us running again. We don't have time to investigate." Is there a way to get the business running quickly and keep the chance to find out what happened? Think about it, then check the model answer in the note below.

Knowledge Check

Key Takeaways

• Computer forensics (also digital or cyber forensics) gathers and presents digital evidence to a standard that can stand up in court.
• It follows three basic steps: collection (make a forensic image, protect the original), analysis and presentation.
• It is used beyond crime: data recovery, finding the cause of failures, and business incidents.
• Computers and devices store far more data than users see, which is why forensics finds what others miss.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 1
• NIST — SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
• NIST — IR 8354: Digital Investigation Techniques: A NIST Scientific Foundation Review (November 2022)
• StatCounter Global Stats — Operating System Market Share Worldwide