1. Introduction to Computer Forensics

2. The fundamental concern of forensic computing activity is for the accurate extraction of INFORMATION from computer- based systems, such that it may be presented as admissible evidence in court (Sammes and Jenkinson 2000)

3. What is Information? Liebenau and Backhouse (1990), Understanding Information: “ Numerous definitions have been proposed for the term ‘information’, and most of them serve well the narrow interests of those defining it.” “These definitions are all problematic”

4. What is Information? Liebenau and Backhouse (1990), Understanding Information: “…information cannot exist independently of the receiving person who gives it meaning and somehow acts upon it. That action usually includes analysis or at least interpretation, and the differences between data and information must be preserved, at least in so far the information is data arranged in meaningful way to some perceived purpose ”

5. Computer system holds data. Any information that we (the receiving persons) may extract from this data is a result of our analysis or interpretation of it in some meaningful way for some perceived purposes. We have to have a set of interpretative rules which we apply to the data in order to extract the information. (Sammes and Jenkinson 2000)

6. inputoutput Computer Electronic device inputAccepts data - input Processes it according to a given set of instructions outputProduces results - output

7. Input, Output, Computer Program Input – unprocessed data manipulated by the computer Output – processed information or results produced by the computer The set of instructions that the computer follows computer program is called a computer program

8. Computer System hardware the physical equipment used to process a datasoftware computer programs

9. Hardware CPU 010 111..... MainMemory SecondaryMemory I/O Devices

10. Hardware Main Memory Input Devices Output Devices CPU

11. Input/Output Devices Input devices keyboard, mouse enter data and programs into the computer Output devices printer, monitor display the results processed by the computer

12. Memory Bit - Binary Digit Byte = 8 bits KB = KiloBytes = 1024 bytes =2  MB = MegaBytes = 1,048,576 bytes = 2  GB = GigaBytes = 2  bytes Main Memory Nonpermanent Rapid Access Low Capacity Secondary Storage Permanent Non Rapid High Capacity

13. CPU – Central Processing Unit Control Unit  Directs the processing operations  Coordinates the flow of data to Main Memory and ALU Arithmetic Logic Unit (ALU) performs  Arithmetic operations  Logic operations

14. Software Operating Systems  DOS  UNIX  Windows Application Software  Word  Power Point  Emacs, Pico

15. References Liebenau, J. and Backhouse, J. (1990) Understanding information : an introduction. London, Macmillan Tony Sammes and Brian Jenkinson (2000), Forensic Computing: A Practitioner's Guide, Springer Verlag