Computer forensics, also known as computer forensic science or cyber forensics, is the practice of collecting, analysing, preserving and reporting on digital data in a way that it is legally admissible.  The data is examined in a forensically sound manner, governed by guidelines and principles designed to create a legal audit trail.

Computer forensics is an ever-changing, ever-evolving analytical technique, and this is due to the undeniable fact that computers are getting more powerful every single day.  In the early days of computer forensics, it wouldn’t have been unheard of for one detective to sift through the computer files on their own because the storage capacity was so low.

However, in this day and age, with hard drives being capable of holding gigabytes, terabytes even petabytes of data, the task becomes a lot more daunting for anyone computer expert to handle!  They are more likely to be faced with multiple computers and laptops, external drives, peripherals devices, web servers and a complex array of networked business solutions.  The key is to utilise the most time and cost-effective methods to sort through the data, using minimal resources.

Of course, new technology also plays a role in the growth of computer forensics, as new hardware, software and operating systems are constantly emerging.  Computer forensic examiners often need to rely on their problem solving skills, and need to constantly be prepared to test and experiment new technologies as they arrive.  Networking and sharing information with fellow examiners is also an important tool for their analysis.

The growing field of computer forensics is challenging, but with the right resources and knowledge, it is an extremely exciting and satisfying area to work in.

The STOPline has extensive expertise in computer forensics, so if you have an issue that potentially involves the use or misuse of a computer, electronic storage media or system, please contact us as soon as possible.  We will be able to provide some immediate practical advice on the steps to take to preserve the available electronic evidence.

For more information or guidance, please call Andrew McLeish at STOPline on (03) 9882 4550, or email us at