Answer

Computer forensic analyses are useful in cases whenever the computers have been used either to commit a crime or tort, or used to created, modify, or store data that can be used as evidence. Many times an attorney will suspect that there ought to be an email, a letter, or some other, singular, "smoking gun" that will prove his case or destroy his opponent's legal theory. Often, however, the "smoking gun" is not one single document, but rather, an aggregate of documents and artifacts. Artifacts tell the forensic examiner how the computer was used; while documents, fragments, hidden data, and deleted data can be extracted, compiled, and presented as evidence in a case.