Digital Forensics
Definition
The discipline concerned with the recovery, preservation, and analysis of evidence stored on physical digital devices. Primary evidence sources are disk images, volatile memory captures, mobile device extractions, and removable media.
- Scope
- Physical digital devices
- Core sources
- Disk images, memory captures, mobile extractions
- Also covers
- Removable media analysis
- Contrast
- Narrower than cyber forensics' network scope
Common questions
How is digital forensics different from cyber forensics as a discipline?+
Digital forensics centres on evidence physically stored on a seized device, such as a hard disk or phone, while cyber forensics extends further into network traffic, cloud infrastructure, and live intrusion investigation, though the two overlap heavily in casework.
Why does a memory capture matter alongside a disk image?+
A disk image preserves what is written to storage, but running processes, encryption keys, and network connections active at the time often exist only in volatile memory, so capturing RAM before power-off can recover evidence a disk image alone would miss.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Criminalistics
- The application of scientific methods, especially physical and chemical analysis, to detect crime and identify criminals. The term was systematised by Hans...
- Cyber Forensics
- The branch of forensic science concerned with collecting, preserving, and analysing digital evidence from networked environments for use in legal proceedings. Covers...
- Cybercrime
- Offences where a computer network is the tool or the target. Tool-based cybercrime includes fraud, harassment, and intellectual property theft conducted online....
- Expert Witness
- A person whose specialised knowledge is accepted by a court and who gives opinion evidence, not just factual evidence. Forensic auditors frequently...
- Forensic Pathology
- The medical specialty that determines cause and manner of death through autopsy and examination of the body, injuries, and circumstances of death.
- Forensic Science
- The application of scientific methods and knowledge to questions that arise in legal proceedings. The goal is producing findings that are reliable,...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Network Flow Record (NetFlow)
- A summarised record of a network conversation: source IP, destination IP, ports, protocol, byte count, and duration. Flow records do not contain...
Explained in these topics
- The Branches of Forensic Science: A MapThe recovery, preservation, and analysis of data stored on electronic devices and networks for use as legal evidence, while maintaining chain of custody and da...
- Cyber Forensics vs Digital Forensics: Scope and Boundaries