Computer forensics refers to the process of gathering and storing evidence from a specific computing device in a format that is appropriate for presentation in a legal proceeding. This process involves the use of investigation and analytical methods. The purpose of doing computer forensics is to carry out an organised investigation and keep a recorded chain of evidence in order to determine precisely what occurred on a computing device and who was accountable for it.