Which of the following is not a task of computer forensics?

Computer forensics involves the preservation, identification, extraction, and documentation of computer evidence which can be used in a court of law. The main tasks of computer forensics include:

Table of Contents

Data Acquisition

Data acquisition involves creating a forensic copy of the digital media and ensuring it is handled properly to preserve the integrity of the data. This is a core task in computer forensics and ensures the original data is not altered during the investigation.

Data Analysis

Once a forensic copy is obtained, the data is systematically searched and analyzed to identify and reconstruct pertinent information. This involves recovering deleted files, scanning for keywords, data parsing and filtering, decryption, etc. The goal is to uncover relevant evidence to the case.

Data Preservation

A key task in computer forensics is ensuring the original digital evidence is preserved intact in its original state. Strict procedures for maintaining chain of custody and verifying hash values are followed to demonstrate the integrity of the data has not been compromised.

Reporting and Presentation

The findings and results of the examination must be properly documented in a forensic report that may be submitted as evidence in court. The report details the methodology, observations, conclusions and exhibits/screenshots that support the investigator’s findings.

Providing Investigative Support

Computer forensics experts assist law enforcement and legal teams with investigating cybercrimes and technology-related cases. This involves providing technical expertise and helping decipher complex digital evidence.

Recovering Files from Digital Media

Recovering files from digital media such as hard drives, flash drives, CDs/DVDs and mobile phones is a common task in computer forensics examinations. Some key methods include:

Finding Deleted Files

When a file is deleted, the directory entry and contents of the file are marked for overwrite but the data still resides on the media until being overwritten by new data. Forensics tools can scan the unallocated and slack space to recover deleted content.

File Carving

File carving examines the raw data on a drive searching for file headers and footers to reconstruct files. This allows recovering files when directory info is lost or corrupted.

Unformatting Drives

Unformatting recovers files after a quick or full format, which removes file tables but leaves data intact until overwritten. The format process can be reversed to restore file tables and directory structures.

Analyzing File Slack Space

Slack space refers to the unused space in disk clusters. Examining slack space can uncover residual data left after files were deleted or overwritten.

Decrypting Files

Encrypted and password protected files can be cracked using password cracking tools to reveal the decrypted content. However, solid encryption can make files infeasible to decipher.

Repairing Partially Overwritten Files

Forensics software can repair and recover files that have been partially overwritten. Corrupted file headers, fragments, and metadata can potentially be salvaged.

Bypassing File System Damage

In some cases, logical file system damage can make data inaccessible. Tools such as drive enclosures can extract raw data from the disk or bypass the file system allowing file recovery.

Establishing Data Ownership and Attribution

Establishing ownership and attribution of data recovered during a computer forensics examination is crucial for placing the suspect at the keyboard and tying them to the digital evidence. Methods include:

Reviewing File Metadata

Metadata such as file creation/modification times, author info, and editing history can identify who created or modified the file and when these actions occurred.

Looking at File Paths and Names

The directory structure and file names may indicate which user profile or application created the file on a system with multiple users.

Identifying Associated Applications

Applications used to open, create or modify files can be telling. Browser history and bookmarks can reveal specific user activity as well.

Determining Original Media

Original source media may be identified through analysis of disk geometry, file systems, or manufacturing details. This traces copied files back to original drives or devices.

Linking Users to Artifacts

Artifacts found in user profiles, registry hives, email accounts, etc. can connect users to actions taken on the system.

Correlating Event Log Activity

Audit logs tracking logins, file access, policy changes etc. can identify user actions within a definitive timeframe.

Analyzing Network Traffic

Packet captures may reveal IP addresses, MAC addresses, domain logins, etc. associating activity with individual hosts, users, or devices.

Reconstructing User Activities from Evidence

Computer forensics can piece together user actions from digital artifacts to reconstruct sequences of events and user behavior. Some key methods include:

Reviewing Internet History

Browsing history, cache, cookies and downloads can reveal what websites users visited and when.

Examining Emails and Messages

Recovering emails and instant messages provides insight into a user’s communications and correspondence.

Analyzing Registry and Logs

Registry keys and system logs record significant events like attachments opened, devices connected and times users logged in/out.

Evaluating File Timestamps

File creation, modified, and access times offer a timeline of user activity. Comparing timestamps identifies patterns.

Inspecting File Content

The actual content of files themselves can reveal user actions. e.g. Word documents, spreadsheets, photos, etc.

Examining File Metadata

Metadata provides context around user activity. Author, geo tags, edits etc. add details that aid reconstruction.

Correlating Artifact Timelines

Cross-referencing timestamps from multiple artifacts can validate user actions and reconstruct detailed timelines.

Key Differences between Computer Forensics and Ethical Hacking

While computer forensics and ethical hacking both involve analyzing computers for data, there are some key differences between these fields:


The goal of forensics is collecting legally admissible evidence. Ethical hacking aims to identify system vulnerabilities.


Forensics follows methodical preservation of evidence. Hacking uses tools to penetrate systems.


Forensics focuses on investigating past events. Hacking proactively tests defenses.

Data Access

Forensics requires access to data after a security breach. Hackers do not have prior access.


Forensic investigators work with legal authority. Hackers must have signed agreement to test defenses.


Forensics requires expertise to support legal proceedings. Hackers just need technical skills to find flaws.


Forensic actions must uphold rules of evidence. Hackers are bound by client contracts.


The intent of forensics is discovering truth. Hacking intends to confirm vulnerabilities.


Forensic results can influence legal outcomes. Hacking results guide security enhancements.


Forensic reports must adhere to legal standards. Hacking reports have no formal structure.

Key Skills for a Computer Forensics Expert

A successful computer forensics expert requires specialized skills and training. Key skills include:

Understanding Laws and Rules of Evidence

Experts must have extensive knowledge of relevant laws and evidentiary procedures to ensure forensics procedures meet legal standards.

Proficiency with Forensics Tools

Experts must be highly skilled with using forensics software and hardware tools to properly extract and analyze digital evidence.

In-Depth Knowledge of Computers and File Systems

Deep understanding of computer operating systems, file systems, network protocols and digital devices assists in locating artifacts during exams.

Strong Analytical and Problem-Solving Skills

Experts should have sharp critical thinking abilities to deduce what digital artifacts imply and reconstruct complex timelines.

Excellent Communication Skills

These specialists need to communicate technical details and forensic procedures in reports and offer expert testimony in court.

Objectivity and Attention to Detail

They must objectively follow forensic processes without allowing bias to influence findings. Meticulousness is crucial.

Staying Current on Latest Methods and Technology

Regular training is needed to update skills and understand emerging technologies, hacking tools, malware, and mobile devices.

Specialized Certifications

Obtaining respected certifications like GIAC Certified Forensic Analyst (GCFA) validates skills and expertise in the field.

How Computer Forensics Differs from Data Analysis

While both involve examining data, there are distinct differences between computer forensics and data analysis:


Forensics aims to gather evidence for investigations. Data analysis looks to uncover patterns and insights.

Source Data

Forensics focuses on data from devices, systems and networks. Data analysis uses datasets from applications and databases.


Forensics targets specific artifacts tied to an incident. Data analysis explores broad datasets for generalizable findings.


Forensics follows rigorous evidence preservation processes. Data analysis is more flexible exploratory analysis.

Tools Used

Forensics utilizes specialized forensics software and hardware. Data analysis uses statistical applications, data mining tools and programming languages.

Type of Analysis

Forensics performs targeted reconstruction of events. Data analysis looks for trends, outliers and patterns in data.


The result of forensics is a detailed chronological timeline. Data analysis yields general conclusions from datasets.


Forensic results are presented in standardized reports. Data analysis results take various forms like charts, dashboards and reports.

Usage of Results

Forensic results support investigations and litigation. Data analysis drives business decisions and strategy.

Ensuring Digital Evidence Integrity

Maintaining the integrity of digital evidence is paramount in computer forensics. Key measures include:

Following Evidence Handling Procedures

Meticulously adhering to chain of custody practices documents everyone who handled evidence items and chronicles movements.

Isolating Evidence from Networks

Removing media from networks prevents remote data alteration. Devices are often examined in air-gapped workstations.

Preserving Original Evidence Media

Original media should remain untouched. All analysis is done on verified forensic clones, never original drives.

Using Write Blockers

Write blockers prevent modifying attached drives, ensuring no changes to evidence. They are standard for forensic imaging.

Cryptographically Signing Data

Cryptographic hashes mathematically authenticate digital information. Changing a bit alters the hash value.

Documenting Everything

Logs should track all actions performed, tools used, and changes made during acquisition and examination. Comprehensive notes are vital.

Presenting Unbiased Conclusions

Experts must remain objective and only report supported findings. Speculation or exaggeration jeopardizes integrity.

Undergoing Quality Control Checks

Peer review, technical checks and process reviews help catch errors or omissions. Auditable processes demonstrate integrity.

Best Practices for Conducting a Computer Forensic Examination

Following forensic best practices helps ensure examinations yield court-admissible evidence. Key best practices include:

Obtain Proper Authorization

Appropriate legal authority, search warrants, or signed consent is required before starting an examination.

Isolate Devices from Networks

Disconnect media from networks and internet access prior to beginning data acquisition.

Use Write Blockers for Imaging

Attach devices only via write blockers to prevent any modifications to original media.

Cryptographically Hash Evidence

Generate cryptographic hashes to authenticate copies match the original item.

Document Everything Meticulously

Record all steps taken, tools used, items recovered and other relevant information.

Maintain Strict Chain of Custody

Carefully chronicle the seizure, custody, control and disposition of evidence.

Recover Data Methodically

Use structured techniques like file carving and keyword searches, rather than relying on browsing alone.

Hide Irrelevant Personally Identifiable Information

Obscure data unrelated to the investigation to protect privacy.

Present Facts in Timeline Format

Timelines convey chronological computer activity succinctly for non-technical audiences.

Draw Only Justifiable Conclusions

Avoid speculation and only report opinions clearly supported by recovered artifacts.


In summary, computer forensics encompasses many specialized procedures for acquiring, examining, and preserving digital evidence. Key tasks include data recovery, timeline analysis, attributing actions, reconstructing events, and presenting findings. However, forensic experts must scrupulously adhere to sound practices that uphold strict rules of evidence. This ensures all conclusions are derived from pristine digital artifacts untainted throughout the legal process. While related fields like data analytics offer useful insights, computer forensics focuses on collecting court-worthy information in a legally defensible manner.