One of the primary concerns of computer forensics is the impact it will have on the computer owner's privacy. In an article published by the United States Emergency Computer Readiness Team (US-CERT) in 2008, the agency noted that legal concerns over privacy issues is one of the most significant problems that has emerged in the field of computer forensics. Of course, those suspected of heinous or violent crimes will, by society's standards, forfeit their privacy rights temporarily due to the investigation. It is still necessary, however, to safeguard that person's information in the event that they are found not guilty or have their case dismissed. Computer forensics can prove to be a disadvantage if proper safeguards are not in place to ensure that data is protected.
Another major disadvantage of computer forensics is the cost. The cost to maintain a laboratory containing appropriate computers, computer analysis tools, software and security implements to safeguard information can be enormous. The SANS Institute notes that it is possible to build a low-cost work station for the purpose of establishing a place to conduct investigations of an electronic nature. Nonetheless, estimated costs for most commercially produced forensic workstations can exceed $11,000 per unit, according to the Eastern Michigan University School of Computer Forensics Investigations. They too have found ways to cut costs so that students can build their own stations to learn from, but the cost per student is approximately $6,900 as of July 2010.
Another major concern that has been noted by researchers like Emily Virtue at the University of Canberra in Australia is that the forensics investigator can play a role in the preservation or the destruction of important data. A number of issues concerning the corruption of important data are necessary to note. Three possible dangers exist in the retrieval of lost or hidden data. First, there is the inherent danger that the investigator will somehow alter the original data in the process of attempting to acquire it. Data can be lost or, if the investigator performs sloppy work, it can be quite easy for the data to modified. Secondly, there is further difficulty in verifying that the recovered data is even the original data from the hard drive from which it was retrieved. Defense lawyers could make a case that law enforcement officials have deliberately modified data in order to close a case. Although this is not likely in most cases, the possibility exists. Finally, once the data has been recovered, it is possible as well that the process of analysis will also modify it. The non-permanent nature of computer data can make it highly suspect in legal cases.