A plethora of information can be gathered from a computer that has been implicated in the commission of a crime, but it takes people who are specifically educated and trained to extract this data and make sense of it, and computer forensics investigators are those people. There are specific steps that have to be taken in a certain order to be able to extract this data and protect it from damage or harm, analyze and interpret it, look for links (if there are any) to a suspected crime, and then make sure the evidence gathered is strong enough to hold up in a court of law.
Even if a person has deleted emails, files, programs, photos, or other information, that information is almost never truly deleted and can therefore be located and extracted from the computer’s hard drive. For instance, computer forensics investigators can go back into a computer’s memory and see what a person has searched for on websites such as Google, or what key words they’ve typed in to begin a search. For example: the computer owned by a person who is suspected of poisoning a family member to death with arsenic can be searched with specific interest focused on the suspect’s recent internet searches. If investigators look back into the search history and find key words or phrases such as, “arsenic”, “arsenic poisoning”, etc., and find that the suspect researched those topics around the time the crime was committed, then that suspect will have some serious questions to answer from law enforcement investigators as to why those searches were made in the first place.
This is just one hypothetical example of information that can be found with the right person who knows the right places to look.
