Computer Forensics Versus Other Related Disciplines

 Investigators often examine a computer disk not knowing whether it contains evidence—they must search storage media.
if they find data, they piece it together to produce evidence.
Various forensics software tools can be used for most cases.
In extreme cases, investigators can use electron microscopes and other sophisticated equipment to retrieve information from machines that have been damaged or purposefully reformatted.