In the first part of any computer forensics investigation, the investigators need to acquire the devices, such as the computers, so they will be able to conduct their investigations. They will be able to use the evidence they gather to confirm certain crimes and possibly to halt future crimes from that individual. The information that the investigator is able to gather can help to verify a number of things, including statements and alibis.
The information gathered from a suspect can be cross-referenced with the digital evidence taken from a computer or a phone. This evidence might be able to prove or disprove an alibi. A famous example of this in action is with the Soham murders, where the suspect’s alibi was able to be disproved because of the mobile phone records.
The evidence can also determine the owner documents on a computer’s drive. It’s also possible to view the Internet history of a suspect, and this can lead to more insight into the suspect’s intent, known as mens rea. For example, someone who references a site on poisons or how to commit murder, would obviously have some explaining to do if someone they know or had contact with were suddenly killed by poisoning. All of these little breadcrumbs can lead investigators right back to the criminal, so they will be able to focus their investigation on the right people.
Document authentication can be a valuable way of catching criminals, as well. It’s possible to alter documents easily with a computer, even going so far as to change the clock setting to make it appear that a document was written at a different time. Forensic specialists will be able to identify these altered documents, which can be very beneficial in a court case.
As technology grows, it will become more commonplace to see digital forensics investigators helping law enforcement and giving testimony in the courtroom.