The number of crimes involving electronic data is sky-rocketing these days, particularly with the immense preponderance of computers and other digital media in our lives. Thus, data forensics has become a distinct sub-division of forensics science consisting of technical expertise, the finding of electronic evidence, digital investigations and even data recovery. Data forensics is right to use in judicial cases that involve breach of contract, intellectual property theft, discrimination, sexual harassment and so on. Therefore, only data forensics experts can search computers for electronic evidence, make digital investigations, recover lost data and provide technical expertise involving fcomputers' ubiquity.

A normal type of computer investigation cannot detect or extract bits of information remained after deletion. File left-overs, deleted files, hidden and discarded files are searched and analyzed as part of the data forensics analysis. Although it often seems impossible to recover data or to identify the criminal process, experts in this fields have more than once been successful at finding the needle in the haystack. What relevance does such evidence have for legal cases? Well, practice has already proved it that the recovery of a deleted e-mail message can change the course of a trial.

Data forensics constantly needs to face apparently insurmountable challenges. The applications do have far-reaching applications, but it takes hours to extract digital evidence and make it stable. Sometimes the necessary information is buried deep in the corporate electronic system, or sometimes, even if it is physically identifiable it is difficult to separate and analyze extensively, off line. Moreover, for a successful data collection, data forensics has to protect the extracted elements by duplication so that the information is preserved and not altered and spoiled during the process. Great caution, strict standards and lots of skills are required for each of these steps and only the best in the field can succeed.

Someone who has had computer forensics training and is a forensics expert should be contacted immediately, once a breach in the security system or a criminal act against electronic media is detected. This will enable the appropriate and cost-limited data collection in the best conditions possible. Moreover, it is false to assume that data forensics only applies to computer hard drives as the main systems that can store information; there are cases of criminal action involving, USB devices, CDs, DVDs and even voice mail systems. Memory hard drives are now incorporated even in fax and photocopy machines so that many of the documents can be recovered afterwards.