Computer Forensics: Collecting Evidence From A Digital Crime Scene

Todd Hancock, Northern California Computer Crimes Task Force, Napa County Sheriff's Department

Stevenson Hall 1300
11:00 AM - 11:50 AM

A computer forensic examiner approaches his "crime scene" in much the same way that a criminalist examines the scene of a homicide; by applying clear, well defined methodologies and procedures. Computers and digital media are increasingly involved in unlawful activities. The computer may be contraband, fruits of the crime, a tool of the offense, or a storage container holding evidence of the offense. Images, audio, text and other data on these media are easily altered or destroyed. The "art" of Computer Forensics involves the preservation, identification, extraction, interpretation and documentation of computer data. Computers and related evidence range from the mainframe computer to the pocket-sized personal data assistant to the floppy diskette, CD or other smaller storage media.