Adventures in Computer Forensics

What exactly do forensic analysts do? How can this type of work help law enforcement or corporate security managers? If you want to solve a puzzle isn't it often best to have all the pieces? Computer forensics is one piece to the investigative puzzle. There must be some need to conduct this type of investigation. Security managers and law enforcement alike must have proper authorization before conducting this type of analysis on a computer. Security managers should get this in writing as part of their security policy. Check with your lawyers and be aware of privacy laws and how they apply even in the corporate setting. The privacy laws may go beyond a consent to search and consent to monitoring. We can often help piece together past events by looking at recovered files, internet cache, and slack space.