Computer Forensics & Data Recovery
A Practical Baseline Guide for Defense Investigators and Attorneys
Computer forensics is the controlled collection, examination, analysis, and reporting of evidence from computers and related storage. Sources may include desktop and laptop computers, internal and external drives, USB devices, memory cards, network storage, backups, virtual machines, and connected cloud accounts.
Use this page to establish a baseline before relying on a forensic extraction, report, recovered file, timestamp, transfer claim, or attribution conclusion.
Protect the evidence: Do not turn on, shut down, search, connect, repair, or alter a computer or storage device unless the action is authorized and the person performing it understands the possible effect. A powered-off device, running computer, encrypted system, damaged drive, and network-connected system may each require a different response.