Digital Forensics Definition

What is Digital Forensics?

Digital forensics is the term for performing an investigation of digital evidence after a cybersecurity incident. For example, if an organization has suffered a data breach, the company will engage in forensic activities to determine the cause of the breach, affected systems, and the scope of the leak.

The term digital forensics has connotations of law enforcement procedures and collecting evidence for legal action. While this is a potential application of digital forensics, organizations may use the same tools, techniques, and procedures to collect data for their own internal use or to prepare for an insurance claim.

The Digital Forensic Analysis Process

Digital forensics is focused on collecting and analyzing evidence associated with a potential crime or security incident. For this reason, it is vitally important that the evidence collected is complete and has not been tampered with.

During a forensic investigation, the investigators may perform the following steps:

• Identification and Collection: There are a number of sources where a forensic investigator can acquire their evidence. Some common examples are computers, smartphones, removable media, and other IT assets such as printers or network routers.
• Preservation: Digital forensics investigators should take steps to ensure the integrity of collected evidence. For example, hash functions are commonly used to generate a tamper-proof summary of data. Investigators should also use secure evidence storage and maintain the chain of custody to protect evidence against potential tampering.
• Analysis: Once evidence has been collected, the investigators begin looking for evidence related to the incident in question. For example, a ransomware investigation may include analyzing files to identify the malware and identify affected files. Analysis is typically performed on copies of data to protect against potential contamination of evidence.
• Reconstruction: Based on the data collected during the analysis stage, the investigators can begin to determine what happened. At this stage, the investigators can build a timeline and search for evidence to support theories or close gaps.
• Reporting: The end of a forensic investigation is a final report. This should describe the investigators’ actions and provide a full description of what did — or didn’t — happen, along with supporting evidence.

Admissibility in Digital Forensics

In some cases, digital forensic investigations may be performed to support a current or future court case. However, even if this isn’t the case, the rules for admissible evidence are still best practice. The requirements include:

• Integrity: The evidence should not have been altered since it was originally collected.
• Authenticity: The chain of custody should be documented and traceable back to the initial collection, and the evidence should not have been tampered with.
• Relevance: The evidence is pertinent to the investigation.
• Legally Obtained: The evidence cannot have been obtained illegally.
• Convincing: The evidence should be complete and support the sequence of events proposed by the investigator.

Conclusion

Digital forensic analysis is the process of investigating an incident and collecting evidence. This evidence may be used in a court case, to support an organization’s incident response efforts, or as part of an insurance claim.