Computer Forensics
Definition
Application of investigative and analytical techniques to identify, preserve, acquire, examine and present digital evidence in a legally defensible manner. Five-stage pipeline: identification, preservation, acquisition, analysis, presentation.
- Pipeline stages
- Identification, preservation, acquisition, analysis, presentation
- Goal
- Legally defensible handling of digital evidence
- Scope
- Cyber crimes and digital evidence generally
- Output
- Findings presentable in court or investigation report
Common questions
How does computer forensics differ from general IT support or system administration?+
IT support prioritises restoring a system to working order, which can overwrite timestamps, logs and deleted data. Computer forensics prioritises preserving the evidentiary state of the system first, using write-blockers and verified imaging, before any analysis that could alter the original media takes place.
Why is the preservation stage placed before acquisition in the pipeline rather than being folded into it?+
Preservation covers securing the scene, device and volatile state (such as a running process or network connection) before anything is copied, while acquisition is the technical act of imaging the media. Separating them keeps the chain of custody defensible even when preservation decisions, like whether to pull power or shut down cleanly, must be made before an image can be taken.
Related terms
- Bit-Stream Image
- Sector-by-sector exact copy of a storage medium, including unallocated and slack space. Created with dd, FTK Imager, EnCase or X-Ways. Output formats:...
- BSA 2023 Section 63 Certificate
- Mandatory certificate accompanying any electronic record produced as secondary evidence in Indian court. Replaces IEA Section 65B from 1 July 2024. Signed...
- Digital Evidence
- Any information of probative value stored or transmitted in binary form. Latent, volatile in part, easily altered, and admissible only if integrity...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Volatile Evidence
- Data that exists only while a system is running: active processes, logged-in sessions, network socket state, decryption keys in memory, and command...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...