In the case quoted above, the CIO believed that his IT department had been on a storage buying binge and it was high time to in fact use more of the raw disk capacity on the machine room floor that was already powered-up and spinning.

FORBES: No new storage in 2013

It also makes it easier to find the files that have been created, accessed and modified during an attack, and it is able to reconstruct deleted files from raw data found in various hidden parts of a computer's hard disk, such as unallocated space and file slack.

ECONOMIST: Forensic computing studies the anatomy of computer crime