Effective Incident Response Team, The

Summary

Now that you've read an overview of computer forensics and a short summary of some of the issues involved, you probably have a question hanging in your mind: Why do you need to consider computer forensics for your organization? Computer forensics are used in organizations for many reasons: to solve the mystery of exactly what a particular user did to the system, to recover “deleted” data, to ensure compliance with policies, to investigate possible misuse of the organization's systems, and to prepare evidence for an internal or even a court case.

Computer forensics is the process of extracting evidence from computer storage media and guaranteeing its accuracy and reliability. The rules and methodologies followed with any forensics investigation ...