Digital Forensics
Definition
The discipline concerned with the recovery, preservation, and analysis of evidence stored on physical digital devices. Primary evidence sources are disk images, volatile memory captures, mobile device extractions, and removable media.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Criminalistics
- The application of scientific methods, especially physical and chemical analysis, to detect crime and identify criminals. The term was systematised by Hans...
- Cyber Forensics
- The branch of forensic science concerned with collecting, preserving, and analysing digital evidence from networked environments for use in legal proceedings. Covers...
- Cybercrime
- Offences where a computer network is the tool or the target. Tool-based cybercrime includes fraud, harassment, and intellectual property theft conducted online....
- Expert Witness
- A person whose specialised knowledge is accepted by a court and who gives opinion evidence, not just factual evidence. Forensic auditors frequently...
- Forensic Pathology
- The medical specialty that determines cause and manner of death through autopsy and examination of the body, injuries, and circumstances of death.
- Forensic Science
- The application of scientific methods and knowledge to questions that arise in legal proceedings. The goal is producing findings that are reliable,...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Network Flow Record (NetFlow)
- A summarised record of a network conversation: source IP, destination IP, ports, protocol, byte count, and duration. Flow records do not contain...
Explained in these topics
- The Branches of Forensic Science: A MapThe recovery, preservation, and analysis of data stored on electronic devices and networks for use as legal evidence, while maintaining chain of custody and da...
- Cyber Forensics vs Digital Forensics: Scope and BoundariesThe discipline concerned with the recovery, preservation, and analysis of evidence stored on physical digital devices. Primary evidence sources are disk images...