Sophisticated computer users may be able to destroy direct evidence of their crimes using computers, but given the proper tools and methods of computer forensics, indirect evidence could be marshaled to reconstruct the crime. This volume describes the nature, history, and current practice in traditional computer forensics (dealing largely with media acquisition and analysis). The authors look at the use of computer forensics in law enforcement and forensic accounting. They also describe the relatively newer field of intrusion detection and forensics, offering case studies and suggesting future research directions.