Any organization that does not have a way to detect and stop malicious behavior can be victimized with no legal recourse. Preserving evidence according to Federal Rules of Evidence gives choices that otherwise would not exist. When an intruder attacks or steals from an organization, the ability or threat to get law enforcement involved may be the only way to reduce the damage or prevent future occurrences. Gathering computer evidence also is useful for confirming or dispelling concerns about whether an illegal incident has occurred and for documenting computer and network vulnerabilities after an incident. Companies employ computer forensics when there is serious risk of information being compromised, a potential loss of competitive capability, a threat of lawsuits or potential damage to reputation and brand.
Some companies regularly use forensic investigations to check employee computers.
In theory, employees are less tempted to stray when they know they are being watched. On the other hand, when the cost of a forensic investigation exceeds potential gain, there is little reason to use it. Companies have used legal evidence gathering to drive home points with employees and external intruders even though the cost of investigations exceeded recovery. Usually, however, a full-scale investigation is not needed to stop an inappropriate action such as surfing that wastes time. Computer forensics also may not be needed when computers and networks play a minor role in an incident or threat, but this may not always be clear.