The process of searching digital media parallels the process of investigating a crime scene, in the sense that investigators don't know ahead of time what they are looking for. Generally, the first step in a computer forensics analysis is to make a copy (also known as an image) of the data to be analyzed. Experts then use specialty tools, such as Guidance Software's EnCase to collect and analyze digital evidence. Special care must be taken to preserve data stored in the computer's memory that will disappear when it is turned off, and any other information that is lost when the computer is turned off.

The computer forensics expert must take detailed notes during every step of the process. These notes are used to write a full report about the analysis and its conclusions. If the computer evidence is used in a case that goes to trial, the computer forensics expert may be required to testify in court about the work.

Computer forensics is an ever-changing field of forensic science that is very much in demand, as you can see by looking at job sites like The field promises continued challenging and exciting career opportunities as digital media becomes increasingly pervasive.

Consider a computer forensics degree to get started on your career path in the area.