The purpose of computer forensics is using a computer to investigate various types of crimes that occur and possible evidence of a crime. This process involves copying data and saving information stored on electronic media. This will include a standard hard drive and removable media such as a flash drive. Using computer forensics to solve crimes is done by retrieving data that has been encrypted, has been deleted or even damaged in some way.
Electronic information that is obtained to solve crimes includes email, a website that a user has visited, the information that was viewed on a particular page and any data that has been downloaded. Many of the processes involved in computer forensics also includes monitoring, viewing, imaging and analysis of data. Crimes that can be soled by these processes include computer fraud, homicides and other types of computer related crimes.
The process of imaging when used for computer forensics is copying the entire image of a hard disk for the purpose of looking at the data. The image of the disk contains all of the data stored on the media. If a disk is being imaged, all information is being copied. This includes data that has been deleted off of a disk in an attempt to hide or get rid of information. Typically, the analysis of a hard disk is not done on the original media.
One hurdle to performing computer forensics is the encryption of data. Extra steps need to be taken if a hard drive or data has been encrypted. Sometimes encryption will need to be broken to view all the data or files that have been encrypted. The analysis of a computer system is usually done in a department for data processing or specific laboratories for this purpose. Retrieval of data using computer forensics is a way to provide technical evidence.
![Almost Like Another Planet... Pamukkale Blues (UNESCO World Heritage) [Explore #1, THANK YOU] Almost Like Another Planet... Pamukkale Blues (UNESCO World Heritage) [Explore #1, THANK YOU]](http://static.flickr.com/7079/7209710670_f67079c754_t.jpg)








