How to hunt for clues on the computerInvestigators start by taking detailed photos of a computer and its components. One thing they never do is turn a computer on, because even that action can write over a potentially incriminating file. Files are never really deleted unless they are written over by another file, which occurs randomly in a hard drive, Kennedy said. Investigators make an exact copy of the hard drive to preserve the original as evidence. That copy is subjected to special software on high-speed computers that can find and extract files, Kennedy said. From there, it is the job of the investigators to turn what they find into viable courtroom evidence, Holland said.
Aiding in corporate investigationsComputer forensics is not limited to law enforcement. The Center for Computer Forensics, based in Southfield, Mich., handles a lot of corporate investigations, such as allegations that an employee is stealing from or sabotaging a company, said Ives Potrafka, lead investigator for the company. Much like police, the company investigator will preserve the data first and ask the employer to explain the problem. Then the investigator starts running key words on the computer to find incriminating active files or deleted files that are hidden away in the hard drive, Potrafka said. "An employer might be able to find some evidence, but it is important to have a professional preserve the data,” he said. "An employer might destroy the evidence if not done right.” Often cases involve allegations from employees about another or violations of company policies, such as romantic relationships, Potrafka said. Some workers get in trouble simply for stealing music and storing it on the company's computer. The bottom line, Potrafka said, is if it was ever there, it is still there and they will find it.