Extracting evidence from digital devices such as handphones. It usually involves retrieving data from existing or deleted files, interpreting their meaning and putting them within the context of the investigation.

“Computer forensics is not solely about computers.  It is about the rules of evidence, legal processes, the integrity and continuity of evidence, the clear and concise reporting of factual information to a court of law, and the provision of expert information concerning the provenance of that evidence”

Marcella & Greenfield