Digital Evidence and Computer Crime, 3rd Edition

Chapter 15

Computer Basics for Digital Investigators

Eoghan Casey

Contents

A Brief History of Computers

Basic Operation of Computers

Representation of Data

Storage Media and Data Hiding

File Systems and Location of Data

Dealing with Password Protection and Encryption

Although digital investigators can use sophisticated software to recover deleted files and perform advanced analysis of computer hard disks, it is important to understand what is happening behind the scenes. A lack of understanding of how computers function and the processes that sophisticated tools have automated makes it more difficult for digital investigators to explain their findings in court and can lead to incorrect interpretations of digital evidence. For instance, when ...