Compiling Definitions of Digital Forensics

"Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media."

This comes from the FBI's website, I believe it is the most accurate definition of computer forensic science.

http//www.fbi.gov/about-us/lab/forensic-science-communications/fsc/oct2000/computer.htm/

"Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media."

This comes from the FBI's website, I believe it is the most accurate definition of computer forensic science.

http//www.fbi.gov/about-us/lab/forensic-science-communications/fsc/oct2000/computer.htm/

That definition fails to include analysis, which is an integral part of the process. Additionally, DF goes far beyond traditional computing devices and so the "stored on computer media" is outdated also.

As Patrick said, if you believe it's the most accurate, then what about investigation?

You acquire the data, you preserve the data, you retrieve the data??? and then fly in your expert to court to present the data that you never examined.

"Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media."

This comes from the FBI's website, I believe it is the most accurate definition of computer forensic science.

http//www.fbi.gov/about-us/lab/forensic-science-communications/fsc/oct2000/computer.htm/

To add to the comments made by Patrick and forensicakb there is also ' test '.

You may also find that the terms expressed in this thread, so far, are terms used in other fields of forensics and/or science and none are exclusive to digital forensics.

Very interesting discussion. I love this. I did a something similar in the early stages of my research where I asked approximately twenty persons who carry out DF related activities (law enforcement, lawyers, technicians etc) to define the term "digital forensics". All definitions differed. The law enforcement personnel related it more to investigations, lawyers related it to courts and the techies focused on the capturing of the data. My definition from all that, the collection, preservation, analysis and presentation of digital evidence. I must say I agree that the term forensics is taken very lightly in terms of digital forensics or is it just out of place? Dare I ask in a forensics forum, what exactly is e-discovery. roll

eDiscovery is the process of producing responsive or potentially responsive Electronically Stored Information in response to legal obligations arising during the Discovery phase of litigation.

eDiscovery has many of the same steps as Forensics ID, preservation, collection, processing, analysis/review, production, and presentation. However, in eDiscovery the review is conducted by attorneys and paralegals instead of by forensic examiners or investigators, and you could argue that the review staff is "friendly" since one is performing the process on their own data and not the other side's. Also, generally eDiscovery is only concerned with active documentary files there is no attempt to identify or recover deleted data, nor is there an examination of system artifacts to determine the state nor integrity of the system which contains the documents or email. (If there is a claim of evidence spoliation, forensics may become involved to resolve issues, however this is not part of the eDiscovery process per se.)

"Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media."

It is a reasonable attempt, but it seems pretty much like it equally well describes an exercise in data recovery or eDiscovery. While something CF practitioners do, it doesn't seem to hit the heart of the matter in my opinion.

Perhaps there isn't a heart – perhaps there's just a playing field, a border zone lit up by two separate sets of floodlights, one managed by computer experts, and the other by experts in jurisprudence? And not always synchronized.

Perhaps 'an area of study that embraces all point of matter which may bring the specialist on Information and Communication Technology into contact with the law'.

Or 'a branch of study that deals with the application of ICT knowledge to legal problems and legal proceedings.'

(No, the first still seems to lack something, and the second seem a bit too wide … in both the focus is getting closer to the legal arena, where I think it belongs. Both attempts are tweaks on definitions of 'medical forensics' I found on the net to get them deal with computers instead of medicine. I figure that the medicos must have faced the same problem of definition, and as they have had a longer time to think about it, they probably have come closer …)

"Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media."

It is a reasonable attempt, but it seems pretty much like it equally well describes an exercise in data recovery or eDiscovery.

That's not even a sufficient definition for eDiscovery.

Also, whilst ED is the intersection of technology and law, CF is the intersection of technology, INVESTIGATIONS and law. There are certain investigative methodologies which are used in ED, but as I said earlier, the focus is different.