“Computer forensics is the specialized practice of investigating computer media for the purpose of discovering and analyzing available, deleted, or "hidden" information that may serve as useful evidence in a legal matter. “ (Steen, Hassell 2004) Computer forensics has become a very important factor in criminal investigations. Since computers have become mainstream, the need for a science that deals with technology has become an issue for the judicial and legal system. Some of the areas of use of computer forensics are:§ Copyright infringement§ Industrial espionage§ Money laundering§ Piracy§ Sexual harassment§ Theft of intellectual property§ Unauthorized access to confidential information§ Blackmail§ Bribery§ DecryptionWhen the investigator finds a computer that may contain evidence, first create an exact image of the drive. This prevents any unintentional damage to the system. The cloned image is important because when you turn on a computer more than 160 changes are made to the files that can change or delete important evidence. When a file is modified, several events occur on a computer. A file status creator is set, meaning their space is now available. But even if you have deleted the file, it remains in the same place and is called free or unallocated space and is available until the entire space is overwritten by another file. The computer forensic specialist can recover the data as long as it is not overwritten by the new file. Another place to hide information is called free space, which means that sometimes the information stored in one area does not use all the available space in the designated place and the unused part becomes the free space..