Digital Crime Investigation and Forensics

In Chapter XIV we discussed digital evidence and the process of collecting this evidence. In this chapter, we are going to focus on the investigative process. In fact, we are going to divide this process into two processes that are both related. The first process is known as computer forensics in which we investigate crime scenes that involve data on computers. We will look at the different parts of the computer and how digital evidence can be either hidden or extracted from the computer. In the second process, we consider the crime scene as not one computer but a network of computers. Our investigation then goes beyond one computer to include the infrastructure of the network and all points in the network where evidence can be either hidden or extracted. This second process we will refer to as network forensics.