Hard evidence from computers

It is becoming more and more common for criminals to use computers in the execution of a crime and there are many ways of recovering information from an assortment of storage media to find out what a computer has been used for. However, to do this, one must first know which computer has been used; without a target machine it is very difficult to link a person with a crime. In perpetrating a crime it is often only the output from a computer, in the form of a letter, set of accounts, counterfeit document or pornographic picture, which is recovered by the investigator. Document examination skills can be used to link these documents with a particular printer and thus lead to the computer that has been used. By combining the sophisticated techniques of the computer analyst with the more traditional skills of the document examiner, the Forensic Science Service has developed an investigation unit capable of assisting in a wide range of circumstances from the initial discovery of a crime to the presentation of evidence in court. The paper presents a survey of the types of evidence that may be gained from the examination of documents produced by, or associated with computers