Digital forensics is the careful, repeatable collection and analysis of electronic evidence. The goal is to learn what happened without damaging the proof, so findings stand up in an organization or a court.

Core principles

  • Preserve original evidence; work on copies.
  • Document every action, with who, what, when and why.
  • Be repeatable: another examiner using the same method should reach the same result.
  • Stay within authority: collect only what you have legal or policy permission to collect.

Order of volatility

Collect the most fleeting data first:

  1. CPU registers and cache.
  2. Memory (RAM): running processes, network connections, encryption keys.
  3. Network state and routing tables.
  4. Running processes and logged-in users.
  5. Disk contents (files, deleted data, logs).
  6. Remote logs and monitoring data.
  7. Backups and archives.

Powering a machine off destroys memory evidence, so a decision to pull the plug or keep it running should be deliberate and recorded.

Making a forensic image

Never examine the original disk directly. Create a bit-for-bit forensic image through a write blocker, a device that prevents any change to the source. Then verify with hashes: compute a hash of the original and of the image; matching values prove the copy is exact and later show it has not changed.

On a practice disk image of your own, the verification step looks like:

sha256sum evidence.img > evidence.img.sha256
sha256sum -c evidence.img.sha256

Common sources of evidence: hard drives and SSDs, phones, memory dumps, cloud accounts, email, browser history, system logs and network captures. Tools used by examiners include Autopsy and Sleuth Kit for disks, and Volatility for memory analysis.

What analysts look for

  • Timeline of file creation, modification and access times.
  • Deleted or hidden files that still leave traces.
  • Program execution, USB device history and login records.
  • Persistence mechanisms and unusual network connections.

Remember privacy: personal data seen during an investigation must be handled carefully and shared only with those who need it. Practice with sample images from training sites rather than real people’s devices.

Check your understanding

1. Which data is the most volatile and should be collected first?

  • Backup tapes
  • Memory (RAM)
  • Archived logs
  • Printed reports

Answer: Memory (RAM). It disappears when power is lost.

2. What does a write blocker do?

  • Speeds up copying
  • Prevents changes to the original evidence while it is read
  • Encrypts the drive
  • Deletes malware

Answer: Prevents changes to the original evidence while it is read. This preserves integrity.

3. How do examiners prove a forensic image matches the original?

  • Comparing file icons
  • Comparing cryptographic hash values
  • Checking the filename
  • Rebooting both

Answer: Comparing cryptographic hash values. Identical hashes show identical data.

4. Why work from a copy of the evidence?

  • Copies are smaller
  • To avoid altering the original
  • Originals cannot be read
  • It is faster to type

Answer: To avoid altering the original. The untouched original stays reliable.

PreviousNext