Computer forensics and records management – compatible disciplines

Purpose To explore the meaning, methods and techniques associated with the subject of computer forensics and consider the implications of computer forensics for records managers and recordkeeping. Design/methodology/approach Critically analyses the principles of computer forensics in the context of records characteristics – authenticity, reliability, integrity and usability – and the UK Association of Chief Police Officers (ACPO) principles and procedures for the collection of digital evidence. Findings The disciplines of records management and computer forensics are potentially mutually compatible. Computer forensics allows for identification of incidents, gathering of evidence, analysis of evidence and potentially recovery of records. Records managers can utilise computer forensics principles to positively enhance records management and have valuable knowledge and expertise to share with their computer forensics colleagues; e.g. metadata expertise, functional requirements for electronic records management, recordkeeping systems design and implementation methodologies, digital preservation and retention management. Research limitations/implications Discusses how computer forensics can be used to highlight inadequate recordkeeping and provide a different perspective on records management based on an analysis of principles and concepts rather than empirical data. Practical implications Highlights the need for records managers to understand computer forensics and computer forensic scientists to understand recordkeeping to support better records management in the electronic environment; raises the implications for educators, trainers and professional societies. Originality/value Very little has been published on the discussion of the potential implications of computer forensics for records managers or how computer forensics can enhance the records management discipline; this paper addresses the gap.