forensics

When you compare Decaf to, say, a modern rootkit, it's apparent how superficial this forensics conflict really is.

The tweet reads: After finding a vulnerability in the voting system they're raiding my house, people from computer forensics.

It's useful for forensics [1], farming (weed and sick plant identification)[2], and some kinds of industrial inspection.

Sometimes the forensics comes from the witness cooperating to give DNA, bite marks, etc as you mentioned.

People who have lost 20 years in jail because the forensics were done by unqualified people or simply incorrect.

It also opens up the ability to do data forensics to try and reproduce a bug, perhaps.

Any real counter-forensics device should be at least as good as the door electromagnet in Cryptonomicon.

Most of the time it still comes from detectives gut feeling, not forensics, that turns a witness into a suspect.

It is an amateurish tool for people who know little or nothing about computer forensics.

The forensics don't come into they are trying to build a case against you.

Combating faulty forensics is a huge task to bear that can take years too.

Coffee does pretty much the same thing every other LEO forensics toolset does.

Every LEO doing "forensics" is basically an EnCase jockey today.

It's funny how Sherlock Holmes stories were considered very clever at first, then there was a backlash from authors like Agatha Christie who emphasized "realistic" psychology and disliked "magical" deductions from surface facts, and then it turned out that Conan Doyle's approach was right after all, because his stories predicted most of modern forensics.

In Computational Forensics, pages 13–24.