ABSTRACT
Computer forensics will be defined as the investigative process involving computers such as personal computers, laptops, Macintosh computers, and netbooks. Computer forensics will require one or more investigative computers. The reason for the multiple computers would be that multiple investigations may occur simultaneously, and some computers have specialized tools and functions. An advantage of an integrated tool is that all of the results from the various searches and operations that people perform are captured centrally, which makes the organization and reporting more straightforward. Write blockers ensure that data are not altered when accessed. Booting a computer can alter hundreds of files in a computer, including access times and other file attributes. Specialized imaging products can be used to extract data from damaged media. There are various ways these products work including the use of different types of read algorithms and hardware adaptations. Audio, video, and graphic files are common evidence that must be processed by an investigator.
