This unit introduces students to the forensic tools, techniques and methods needed to recover digital evidence from a variety of devices. Modern forensic computing involves the preservation, identification and analysis of computer and digital based evidence stored in the form of magnetically encoded information on various devices and media. Computer or digital evidence is often not examinable by conventional computing access methods, so specialised software tools, techniques and processes must be employed to preserve and recover this evidence in a forensically valid manner.