“Computer forensics is the specialized practice of investigating computer media with the aim of discovering and analyzing available, deleted, or “hidden” information that can serve as useful evidence in a legal matter. » (Steen, Hassell 2004) Computer forensics has become a very important factor in criminal investigations. Since computers became commonplace, the need for science that deals with technology has become a problem for the justice and legal system. Some of the areas where computer forensics can be used are:§ Copyright infringement§ Industrial espionage§ Money laundering§ Hacking§ Sexual harassment§ Theft of intellectual property§ Unauthorized access to confidential information§ Blackmail§ Corruption § DecryptionWhen the investigator finds a computer that may contain For evidence, they first create an exact picture of the drive. This prevents any accidental damage to the system. The cloned image is important because more than 160 changes are made to files when a computer is turned on, which can change or delete important evidence. Several events occur on a computer when a file is modified. A file status creator is set, meaning their space is now available. But even if you deleted the file, it remains in the same place and is called free or unallocated space and is available until all the space is overwritten by another file. The forensic computer scientist can recover the data until it is overwritten by the new file. Another place where information can hide is called free space, which means that sometimes the information stored in one area will not use all the space available in the designated place and the unused part becomes free space..