The objective of reviewing the user created data is to find information that may be used to base decisions on as part of an investigation.
[4] A number of forensic search software products will be able to perform data recovery on a range of email file types.
[6] A new generation of tools is being developed in order to address the challenges being faced by digital forensic and ediscovery practitioners.
It is also the case that Forensic Search software does not meet with the higher end tasks outlined in the widely accepted electronic discovery reference model (EDRM).
[citation needed] However, true eDiscovery review is generally the domain of qualified legal practitioners or companies.
[citation needed] An example of this would be attempting to explain to a lay person the method and techniques of decoding the UserAssist Key in the Windows system registry.
[citation needed] Once collection phase was complete these images were reviewed and the ESI that was relevant was supplied to the interested parties.
This required the computer forensic investigator to have a good deal of experience and training in: This process was time-consuming and costly.
What would immediately flag the interest of a detective with a deep knowledge of the case and parties involved may go unnoticed by a computer forensic expert.
Recognizing these challenges, the concept of Hybrid Forensics has been discussed and the creation of tools that adopt a different approach to collecting data.
The concept of Hybrid Forensics is the selective collection of data from 'live' systems in such a way that it may be considered as being reliable evidence in court.
[citation needed] Albeit that time and resources are low the main knowledge in the unit comes from officers or consultants with 7+ years of experience (this predates most computer forensic degrees available).
These officers have become familiar over time with the methodology of using a forensic analysis software package as this is all that was on offer when they started in the field.