« « Phases of Computer Forensics (2)

Critical Components to Study Computer Forensics

The knowledge and skills needed to investigate crimes involving computers will change from case to case; nevertheless, investigators need to understand how computers operate at the component level and how each component interacts with the others. Critical components include the following:

  • The central processor and how it works with the physical RAM (random access memory)
  • How the physical RAM works with various operating systems, which provide virtual memory on hard disks
  • How independent devices on the computer’s I/O (input/output) bus interact with each other
  • How all these items store and retrieve data in physical storage, such as hard disks

Investigators might consider reviewing the material for or taking a basic certification exam, such as the CompTIA A+ certification, which is designed to certify the basic PC knowledge level required for PC technicians.

Investigators should also keep in mind that although certifications are certainly worthwhile, continued education and experience are essential. In addition to knowing how the basic computing components interact, the investigator will need to understand the specific operating systems, applications, and file systems involved in the investigation.

This knowledge is relegated not only to the analysis phases of computer forensics but also to the collection phases. Many vendor-specific certifications may be helpful to the investigator to guide his training in operating systems and applications.

Related entries

Digg it StumbleUpon del.icio.us Google

Leave a reply