Digital Forensic Investigations and eDiscovery
摘要
Forensic software is used to acquire and analyze digital evidence. It is employed by a forensic examiner during a digital forensic investigation to discover and document relevant facts related to a case or issue. These software tools are designed to assist forensic examiners in the analysis of digital evidence. The number and variety of such software packages has increased dramatically over the last 30 years—in 1989, there was only one such tool; today, there are hundreds, perhaps thousands, all dedicated to finding a smoking gun amid billions of ones and zeros.