IT Forensics

Forensic appraisals are a special case, which is used in both official and private appraisals. In computer forensics or digital forensics, IT systems are examined, digital traces are evaluated and saved. Possible applications could be

• Computer fraud
• Fraud with access permissions
• Data falsification
• Data modification / computer sabotage
• Spying / intercepting data

The forensic worker's work begins with the first access to the IT systems to be examined (for example during a house search). Grade at this the first important point often dispenses with the presence of an expert, which leads to serious errors and which complicate a subsequent investigation of the hardware or even thwart. Thus turning off a computer may result in e.g. no longer can be accessed on encrypted volumes, or deletion routines are triggered, the important pieces of evidence destroy. Also, the memory of a computer can still contain important evidence that must be backed up on the first access. Therefore the expert secures the RAM of a running computer at the first access and checks, if necessary. encrypted data carriers are integrated, which must be secured before turning off the computer, so that a complete evaluation is possible.