How Computer Forensic Investigators (CFIs) Recover Evidence

In the world of forensic science, computer forensic investigators (CFIs) are an integral part of recovering evidence and building cases for prosecutors. This is especially true in computer crimes, such as distributing child pornography or money laundering, but computers are used in the commission of a wide variety of crimes. So how do CFIs recover evidence, and what is the role of a computer forensic investigator?

These days, CFIs can do miraculous things in their labs - everything from tracking down information for detectives to exploring the complicated innards of suspects' computers to logging Internet activity. Their role in criminal investigation is essential, and they must undergo continual training if they want to keep up with technology. Most police departments employ several computer forensic investigators, and federal agencies have them as well.

To recover evidence from a computer, CFIs need only the hard drive from the machine itself. They use software programs, hardware, and other investigative techniques to recover information that perpetrators think they have eradicated from their machines. In reality, it is quite difficult to erase every aspect of a file or document, and although it is possible, police often confiscate computers before the perpetrator has a chance to get rid of incriminating evidence.

First, computer forensic investigators look at saved files, which are those that have not been deleted from the machine. They are trained to look in obscure folders for information that you normally wouldn't find there, and have software that enables them to bypass passwords that otherwise wouldn't be accessible. For this aspect of evidence recovery, CFIs must know how directories are assembled in computers and how to backtrack through files to find information.