Forensic computing: Which description best captures the goal?

• A. It captures, processes, and investigates data security incidents for court admissibility
• B. It designs security architectures
• C. It programs digital devices
• D. It audits network traffic in real time

Answer: (A)

In forensic computing, the primary goal is to collect, preserve, and analyze digital evidence so it can be presented in court. This means establishing a solid chain of custody, using validated and non-destructive methods, and ensuring the integrity of the data (often with forensic imaging and hashing) so the evidence remains admissible under legal standards. The focus is on preparing evidence that can withstand legal scrutiny, not on building security architectures, programming devices, or real-time network monitoring. Those activities are about security design, development, and incident monitoring, while forensic computing centers on evidentiary collection and analysis for legal proceedings.