Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.1.1 Computer Forensics And Digital Forensics
The movement from computer forensics to digital forensics is presented in this section.
Wang, Cannady, & Rosenbluth (2005, p.119) defines computer forensic as a
developing discipline rooted in forensic science and computer technology, focusing on
acquiring, analysing and presenting evidentiary evidence from computer systems to
prosecute computer involved crimes and offences. Another notable definition was
provided by Britz (2008). Dixon (2005, p.7) stated that the central parts of computer
forensics are the preservation, identification, extraction, documentation and
interpretation of computer data.
Caloyannides, Memon, & Venema (2009) state that computer forensics is
performing static analysis on a single compromised computer system and missing
dynamic information, such as network connections, malwares in the memory and
decryption keys. Many other electronic devices such as laptops, Personal Digital
Assistants (PDAs), mobile phones, printers, fax machines and tablet PCs have been
developed and widely used. The range of devices that are of interest to computer
forensics investigation is broadened to include the new popular electronic devices. A
new terminology “Digital Forensics” has been created and the term represents better
the current state of computer forensic environment. The term “Computer Forensics” is
still commonly used to refer to any investigation involving computers. The first
Digital Forensic Research Workshop (DFRWS, 2001) defines digital forensic science
as follows:
The use of scientifically derived and proven methods toward the
preservation, collection, validation, identification, analysis, interpretation,
documentation and presentation of digital evidence derived from digital
sources for the purpose of facilitating or furthering the reconstruction of
events found to be criminal, or helping to anticipate unauthorized actions
shown to be disruptive to planned operations (p. 16).
Some practitioners now prefer to use Digital forensics to describe a greater scope of
potential evidence than what is included in computer forensics literature and often use
more specialised terms such as mobile forensics and network forensics.
9