Computer forensics investigation an approach to evidence in cyberspace

In the recent years, analysing a computer or a digital device has become a necessity in the field of criminal investigations. However, during the forensic analysis some ordinary mistakes are often made. This paper aims at defining a new approach to the problem of evidence examination, studying the practical experience of a case study within the Italian legal system concerning techniques of forensic computer analysis based on command line. The user of this type of approaches has to guarantee efficient level of both technical skills and highly qualified and specialized legal competences in order to analyse digital systems in conformity with international best practices, and national and European regulations. Moreover, although many specific hardware and software are adopted in the forensic tests, one of the main objectives of this research has been the only use of the personal computer in order to prove the possibility to obtain the same results minimizing the costs. The case study has focused on forensic analysis of various magnetic and optical devices (mass memory), such as hard disk, pen drives, cards and CD / DVD.