Digital Forensics

Digital forensics, a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime. The word known as the digital forensics was originally used as a synonym for computer forensics but has expanded to cover all devices capable of storing digital data and is now used to describe the entire field.

Investigations can be classified into four categories. The most common verities are the forensic analysis, where evidence is recovered to support or oppose a hypothesis before a criminal court; this is closely related to intelligence gathering, where material is intended to identify other suspects/crimes. eDiscovery is the form of discovery related to civil litigation and intrusion investigation is a specialist investigation into the nature and extent of an unauthorized network intrusion. The technical part of the investigations is divided into several sub-branches; computer forensics, network forensics, database forensics and mobile device forensics.

Forensic Process

A digital method of forensic investigation commonly consists of 3 levels; acquisition or imaging of exhibits, analysis and reporting.

The first level, acquisition, involves creating an exact sector level duplicate (or "forensic duplicate") of the media, often using a write blocking device to prevent modification.

The actual method of analysis can vary between investigations, but common methodologies include conducting keyword searches across the digital media (within files as well as unallocated and slack space), recovering deleted files and extraction of registry information (for example to list user accounts, or attached USB devices).

Once the evidences are recovered the information is analyzed to reconstruct events or actions and to reach conclusions, work that can often be performed by less specialist staff. When the process of investigation is complete the investigator presents his data, usually in the form of a written report, in lay person’s terms.