Skip to main content

Of course, we leave behind a lot of information and insights into our character, behavior, interests and plans on our computers. This data can be used in investigations, both criminal and civil in nature.

The term computer forensics refers to a form of digital forensics. Digital information and evidence taken from a computer are used to aid in an investigation. While computer forensics was originally limited largely to online fraud and hacking, today it serves a powerful investigative tool for a number of crimes including theft, murder, harassment, abuse, and rape.

In this blog post, we’ll review sources of computer forensics data, its purpose, and three-step legal process.

Sources of Computer Forensic Evidence

Internet History

Why do we use the internet? To find information. People leave behind a large digital footprint online, and this includes the websites they’ve visited. Profiles on online dating websites may indicate adultery in a divorce case. Searches for poisonous cocktails could point to murder. This history may also be helpful in establishing a motive.


Emails are an extremely powerful tool. As hard as we might try, it is quite difficult to erase an email completely. Messages may be analyzed to prove criminal behavior, such as tax fraud or drug dealing.

Text Messages

Although less common, it is possible to send a text message from your computer. These messages often contain intimate, revealing material that may be pertinent to a civil or criminal case.

Social Media

Social media now plays a large role in computer forensics. In fact, in a survey compiled by the  American Academy of Matrimonial Lawyers (AAML) in 2010 reported that 4 out of 5 family law attorneys had used social media evidence in a divorce case. Facebook was said to be the primary source for 66% of the attorneys.

What makes social media such a powerful source of computer forensics? Photos, messages, likes and posts intersect for a powerhouse of intimate information.

Files and Images

Even if you use your  smartphone most of the time, you probably have a number of documents and images on your computer. You may even store data from your smartphone on your computer as a means of backup.

Financial records, legal documents, and personal photos are often used in cases.

Analyzing Criminal Activity

As our lives become intertwined with our online activity, computer forensics is being used in more and more criminal investigations. You’ve likely seen articles about thieves who take selfies with their loot or even people who sell drugs and firearms online. However, proving criminal acts through computer forensics don’t always have to be that transparent.

Investigators may review deleted files, communications, and images to track criminal activity. They’ll likely also analyze online search history and social media activity. Just about everything we do online leaves a trace, and the best investigators can follow it.

Locating Suspect and Determining Location History

Digital forensics can be used to locate a suspect or analyze someone’s whereabouts. Smartphones, tablets, and even some laptops contain GPS software, the same software you use to navigate online maps and check in to your favorite spots on Facebook.

This information can be accessed by members of the legal community to aid in tracking a suspect. Likewise, professionals working on an investigation may review someone’s history via GPS to determine their location history. For example, if someone says they were at home on a given date, but their location history places them an alleged lover’s residence, this information could help establish the presence of adultery for a divorce litigation.

The 3 Stages of the Computer Forensics Process

The computer forensics process consists of three main stages: acquisition, analysis, and reporting. Following these steps helps ensure the integrity of the investigative process. Once the relevant material is seized, it is then duplicated. The material may not be modified in any way and must be properly stored. Once an exact match is made, the material is analyzed.

Reports are then produced of the collected evidence for a court or client by trained technicians. Finally, forensics experts create a written report, and the material is either accepted or rejected for admission to the courts.

Prudential Associates is a leading provider of computer forensics services. For more information about using computer forensics to aid your investigation in Maryland, Washington DC or Virginia, contact us today.