It's all but impossible to pore over every file on a computer, especially in an era of hard drives that can hold 30 gigabytes or more of information. Twelve gigabytes of text, for example, would stack 24 stories high if printed out. What the forensic investigator looks for first on a seized computer is dictated by the nature of the crime. In a child pornography case, for instance, the investigator may search for photo files first. In a homicide, the investigator may look for written documents.
Investigators often hit pay dirt by resurrecting deleted computer files.
Many computer users don't realize that deleting a file doesn't wipe it clean from the hard drive. Computer forensics investigators are able to track down those files. Depending on the sophistication of the computer's owner, investigators occasionally have to crack encrypted files and passwords. Sometimes, files are concealed in secret places on the hard drive. Other times, they're hidden within other files.