Digital forensics is the process of collecting, preserving and analysing digital evidence in a way that is repeatable and defensible. It answers questions after or during an incident: what happened, how, when, who, and what was affected. It supports incident response and, where needed, legal cases (see Investigation Types).
Types
| Type | Evidence |
|---|---|
| Disk / file system | Hard drives, SSDs, USB media, deleted files, file system metadata |
| Memory | RAM contents: running processes, network connections, keys, injected code |
| Network | Packet captures, flow data, firewall and proxy logs |
| Log | System, application and security logs |
| Mobile | Phones and tablets: messages, app data, location |
| Cloud | Provider audit logs, snapshots of virtual machines, SaaS records (limited physical access) |
Methodology
Identify --> Preserve --> Collect --> Examine --> Analyse --> Report
Always get proper authorisation first; examining data without it can be illegal. Work on copies, never on original evidence, and document every action.
Order of volatility
Collect the most short-lived data first (RFC 3227 style):
- CPU registers and cache
- RAM, running processes, network connections, ARP/routing tables
- Temporary files and swap
- Disk contents
- Remote logs and monitoring data
- Backups and archives
Live vs dead acquisition
| Live | Dead | |
|---|---|---|
| System state | Running | Powered off |
| Gets | Memory, connections, encrypted volumes unlocked | Clean disk image |
| Risk | Tool footprint alters the system | Loses volatile data; full-disk encryption may lock you out |
Common compromise: capture memory live, then image the disk.
Preservation and Integrity
Chain of custody
A record of who held the evidence, when, where, and why - from collection to court. A broken chain can make evidence inadmissible. Record: item description, serial numbers, date/time, person, transfers, storage location, and hash values. Store evidence in sealed, access-controlled storage.
Imaging and write blockers
A forensic image is a bit-for-bit copy of the media, including unallocated space. A write blocker (hardware, or software mode) sits between the evidence drive and your workstation so nothing can be written to the original.
Hashing
Hash the original and the image (for example SHA-256); matching values prove the copy is exact, and re-hashing later shows nothing changed. Concepts are in Hashing Basics; avoid MD5/SHA-1 alone where collisions matter, or compute two hashes.
Key Artefacts
Windows
| Artefact | Reveals |
|---|---|
| Registry (NTUSER.DAT, SYSTEM, SOFTWARE, SAM) | Installed software, USB history, recently run programs, autoruns, user activity |
Event logs (.evtx) | Logons, process creation, service installs, log clearing |
| Prefetch | Evidence that programs executed, run counts, last run times |
| Browser history | Visited sites, downloads, searches |
$MFT (Master File Table) | File names, timestamps, sizes, including deleted entries |
| Recycle Bin, LNK files, jump lists | Deleted and recently accessed files |
Linux
| Artefact | Reveals |
|---|---|
/var/log/auth.log or secure, syslog | Logins, sudo use, services |
~/.bash_history | Commands typed by a user (can be cleared or disabled) |
Cron jobs, systemd units, ~/.ssh/authorized_keys | Persistence |
/tmp, /var/tmp, web roots | Dropped files, web shells |
Timeline analysis
Merge timestamps from file systems, logs, registry and browsers into one ordered timeline to reconstruct the attack sequence. Normalise time zones (use UTC) and note clock skew; compare MACB timestamps (modified, accessed, changed, born). See time-sync notes in SIEM and Log Management.
Tools
| Tool | Use |
|---|---|
| FTK Imager | Create and verify disk images, preview evidence, capture memory |
| Autopsy / Sleuth Kit | Open-source disk analysis, file recovery, timelines |
| Volatility | Memory forensics: process lists, network connections, injected code |
| Wireshark | Packet analysis, see Wireshark |
| Registry viewers, event log tools | Offline analysis of registry hives and .evtx |
| Log/SIEM platforms | Large-scale log analysis, see SIEM and Log Management |
Documentation and Admissibility
Evidence is more likely to be accepted when it was lawfully obtained, the process is documented and repeatable, integrity is shown by hashes, custody is unbroken, and the examiner is qualified. Keep contemporaneous notes, record tool names and versions, and keep originals untouched. Rules differ by jurisdiction; involve legal counsel. Privacy and data-handling laws also apply (see GDPR).
Anti-Forensics Awareness
Attackers may try to hinder analysis, so analysts should expect:
- Clearing or disabling logs and shell history
- Timestamp manipulation (timestomping)
- File wiping, encryption and data hiding (steganography, hidden partitions)
- In-memory-only malware that never touches disk
- Use of legitimate tools to blend in
Mitigations: forward logs off-host, capture memory early, corroborate across independent sources (an altered file timestamp may contradict MFT or log entries).
Key Points
- Preserve first: authorise, image with a write blocker, hash, document.
- Collect volatile data before non-volatile.
- Chain of custody and integrity hashes make evidence defensible.
- Correlate artefacts into a UTC timeline.
Hands-on
- Digital Forensics Fundamentals - methodology, chain of custody, write blockers, Windows forensics
- Registry Furensics (Advent of Cyber 2025) - registry artefacts, USB and program history
- Drone Alone: web attack forensics - tracing a web attack through logs
- Hashing Basics - integrity checking