Digital forensics and the analysis of computers have been a staple in the popular media for several years, particularly in television shows ranging from the Law & Order and CSI franchises to Court TV's Forensic Files. And although the TV shows get many of the details -- and, most certainly, the time required to retrieve useful information -- wrong, there are large grains of truth in terms of the kinds of information that might be retrieved from computers, mobile phones, and other digital devices.

Forensics, of course, is the use of science to investigate and establish facts in a criminal or civil court. Physical evidence (e.g., tire tracks and bullets) and medical evidence (e.g., blood and DNA) are well accepted in courts as well as in the hearts and minds of the law enforcement community and the public.

Less well known -- and much less well understood even within legal circles and the judiciary -- is the role of computer forensics and digital investigations. Computer, network, and mobile device forensics is the acquisition, examination, and reporting of information found on computers, networks, and mobile devices, respectively, that pertain to a criminal or civil investigation. The same processes and methods are applied to corporate and other "private" investigations (although, strictly speaking, investigations differ from forensics). Nearly everything that someone does on a computer (and, make no mistake, today's smartphones are miniature Internet terminals) or a network leaves traces and it is hard to overstate this point; the computer or mobile phone stores a record of every type of activity it which it is engaged.

Let's start with the most obvious source of information; namely, data files. Due to the way in which computer file systems store data -- and this includes Windows, Mac, and Linux operating systems -- data is not removed from the storage medium when a file is "deleted." Indeed, the operating system -- and, therefore, the user -- cannot easily get to the file once it's deleted, but the data still resides on the disk and is easily retrieved using computer forensics tools. That said, the location where the data was stored is marked as available to the operating system so that it will, eventually, be overwritten with other data; thus, it is absolutely imperative that if one needs to obtain data that has been ostensibly deleted, the computer should be turned off and the forensics should start as soon as possible. (Note that both the iPhone iOS and Android operating systems are Linux-based and, therefore, can often be examined to recover "deleted" files.)