Certified Technology Forensics
How does it work? Computer forensics begins with the collection of information in a way which maintains its integrity. Technicians analyze the data or system to determine if it was changed, how it was changed and who made the changes. The use of computer forensics isn't always tied to a crime. The forensics process is also used as part of data recovery processes to gather data from a crashed computer or server, failed hard drive, reformatted operating system or other situation where a system has unexpectedly stopped working.
Forensics technicians typically follow standard procedures, which vary depending on the context of the forensics examination, the computer being examined or the information investigators are looking to find.