Most criminals do not realise that deleting a file still leaves it on the hard disk, for example, or even that formatting a disk can still leave almost all the data extant, even though the disk looks blank to a casual observer. These quirks, which could help investigators, could also be used to hide data from the untrained eye. Mr Wilding said for this reason it was often unadvisable for companies to conduct their own investigations without forethought and possibly consultation. Companies such as Network Security Limited used special non-invasive backup techniques when investigating computers so that not even a single bit was changed on the disk, he said. Another problem was that employees often brought their laptop computers to work and it could be illegal to search through them without already having a lot of evidence.
Most computer criminals are inept and leave a trail of evidence, says a computer forensic expert.
But PC support teams in to investigate fraud may inadvertently destroy evidence. Most computer fraud is committed by non-technical users.