Computer Forensics: When looking at the bigger picture of the computer forensics investigation there are three main areas of action that must take place for a successful investigation. The three main actions are to acquire and preserve the data, analyzing the data and then preparing a report.

Each step of a computer forensic investigation is explained as follows:

The first step is to forensically acquire and preserve the electronic evidence. This requires many specialized tools to practice sound forensic techniques. Although these tools are often cost-prohibitive to individuals and companies, without them the forensic investigation would be compromised and would never hold up in a court of law. For the digital evidence be valid, it must be preserved in its original form. There are two different ways to do this. It can be done by creating a mirror image with a software application, or by using hardware devices. Software acquisitions create a forensically sound image that makes no changes to the information on the subject hard drive. Hardware acquisition tools duplicate hard drives and should set read only access to the subject drive. The forensic image must be identical to the original. No changes should be made to the evidence.

The next step in the forensic process is to analyze the preserved electronic image. During the analysis phase there are many different steps, depending what the investigator is looking for. The analysis of the acquired data is the most time-consuming part of a computer forensic investigation.

Following the analysis of electronic data, the private investigator must be able to present the findings in manner that allows the public to understand them. If the case in question has to be taken to court, the attorney presenting the information must be able to relay it to the audience. This is a critical part of the process. If the information cannot be digested then it is of no use. Many of the high-end computer forensic software packages help the investigator prepare the report in the proper format.

The above illustrates the main points that must be performed in a properly conducted computer forensic investigation. Because of the specialized tools and procedures, not many investigations companies are properly set up to perform computer forensics investigations like ICS.