Unlike the traditional form, digital evidence is extremely fragile and is even more difficult to form into a coherent argument suitable for a court of law. Much of the work is based on reverse-engineered technology that aims to understand the behaviour of undocumented files and technology in use today.

In a criminal investigation a forensic examination requires skills that go beyond that of a conventional data recovery process. The success of such an examination from a prosecution point of view depends not only on the ability to uncover evidence of the act (the ‘actus reus’) but also on the ability to prove the 'mens rae' or intent of the suspected offender. Further to this there is a strict legal process in place for the collection, handling, analysis and presentation of the evidence that must be followed.

A forensic examination of a computer can be a very revealing process that yields the behaviour and habits of an individual. Internet browsing habits, organisation of files on their disk, email conversations, letters, diary entries, chat logs, holiday photos, home videos and financial files all add up to make a "psychological profile" of the computer user.

This talk, previously given in Kent and presented again here from demand, covers the foundations of the subject and the best practice principles used to apply it to the legal process. It will include a live demonstration in the use of Encase to investigate a simulated crime and prove the actions and intent of an offender.