In this high-tech world, interaction is done 99.999% via electronic devices, which means computers. From personal to company communications, from plain messages between workers to complicated codes of industrial intelligence-gathering or money crime, computers are the equipment. Hence the optimum place to find proof of employee misdemeanor in nearly all facets is to examine his computer hard disk. Whether it is a refurbished computer, a used computer or a new computer, remnants of what he did using the machine may be examined to establish whether he committed offenses or not. This field of post facto computer analysis is called computer forensics.

Each computer inputs all keystrokes performed in it, since it must respond to them as instructions. This data is normally kept in the disk in various locations though most may be automatically erased as part of the operating system methodologies. An examination of the computer disks would commonly reveals traces of these, specifically the erased data that have not yet been overwritten by new inputs. Deletion of information in any program merely means the computer will not access it, but it does not go away unless overwritten, and may be ‘read’ by particular gadgets to expose what was thought to be already eliminated.

There are two general bases for computer forensics: when a leaving employee is suspected of fase acts in keeping company secrets restricted during his stay; and if an employee is suspected of underperformance, not using his full time to his work. In the first reason, the computer may be secretly analyzed after the employee has left without anyone knowing; but in the second instance, congtinual computer check-up is the only way to pinpoint goofing off employees without adversely influencing employee morale. Else, spying on the employee will be the alternative, either through electronic gadgets or true spies.

Information retrievable by forensics gadgets include:

1. Records or portions of files that have been erased but not overwritten. As mentioned above, the magnetic composition for the information remains as is unless modified by new keystrokes.

2. Roster of erased file titles even without the files. This may indicate the use of unapproved or banned programs.

3. Websites visited, at any browser setting, even if deleted from browser records. Usually recorded in hidden files or open disk space and traceable in whole or vestiges.

4. Accessed or downloaded Internet information or graphics. Same with the item above.

5. Unknown programs or software utilized.

6. Vestigial information in the temporary files, saved or not. Usually what was being used most lately.

7. Hidden files or those guarded by keys. The programs used can crack the passwords or proceed without them.

Corporate studies indicate that around 20% of employee computer time on the job is used for activities not really related to the work, and this is grossly unfair to the employer. Employee check is thus a method of ensuring correct employee conduct, but there is also such a thing as employee morale and right to privacy. The trick is getting and keeping a balance between the two rights, and computer forensics is just a method to do it.