Think of digital forensics like being a detective — but instead of solving crimes on the
streets, you're solving them on computers, phones, and other digital gadgets. When
something bad happens, like a hacker attacking a website or someone deleting important files,
digital forensics experts find out what happened, who did it, how they did it, and what was taken
or changed.
1. What is Digital Forensics?
Digital forensics is the process of finding, saving, and studying digital information (like files,
messages, or history) from devices to help in criminal cases or to fix cybersecurity
problems.
Real-Life Example:
Imagine a student’s laptop is stolen. Using digital forensics, experts could:
Find deleted files (like homework or pictures)
Check where the laptop was used (using Wi-Fi or IP addresses)
Track the person who logged into websites from it
+----------------------+
| Digital Forensics |
| = Digital Detective |
+----------+-----------+
|
+------------+-------------+
| |
Collect Evidence Analyze Evidence
| |
Preserve It Safely Find Clues (e.g., deleted files)
| |
Make Reports for Court Use Tools like Autopsy, Volatility
2. The Digital Forensics Process – Step by Step
There are four main steps in any digital forensics investigation:
Step Name What Happens? Example
1 Identify Find which devices or data A bank finds fraud, so they check
are important computers, servers
2 Preserve Copy data exactly, keep Use FTK Imager to copy a suspect’s
originals safe phone
3 Analyze Look at data to find clues or Search chat history or deleted emails in
recover lost info a cyberbullying case
4 Report Create a clear report of what Show how and when a file was stolen
was found from the company
Step 1: Identification
What it means: Find out which devices or data might contain important evidence.
Example:
A bank loses money mysteriously. Experts look at:
Bank servers (computers storing customer info)
Employee computers
Security camera footage
They decide which ones are useful for investigation.
Step 2: Preservation
What it means: Protect the digital evidence so it doesn’t get changed or lost.
How:
Experts create an exact copy of the device (called a bit-by-bit image)
The original device is locked away safely
Example:
Police take a suspect’s phone. They don’t check it directly. Instead:
Use a tool like FTK Imager to copy all the phone’s data
Keep the original phone untouched, just like you would with physical evidence (like a
fingerprint)
Step 3: Analysis
What it means: Study the copied data to find clues.
What they look for:
Deleted files
Internet history
Messages
Malware or hacking software
Example:
In a cyberbullying case, they might:
Check chat history
Look at social media posts
Find deleted messages that prove who sent the threats
Step 4: Reporting
What it means: Write a clear and professional report of what was found.
Who uses the report?
Police
Lawyers
Company leaders
Example:
The report could show:
An employee sent company secrets via email
Include timestamps, file names, and even deleted emails as proof
3. Handling Evidence & Chain of Custody
What is Chain of Custody?
It’s a record of who touched the evidence, when, and why.
If this chain is not recorded properly, the evidence might not be trusted in court.
Example:
A USB is found at a crime scene.
A police officer picks it up, notes the date and time.
It’s placed in a sealed bag with a unique ID.
Every person who opens the bag (like lab workers) writes down the time and reason.
Rules for Handling Digital Evidence:
1. Never touch the original device for testing — always use a copy.
2. Lock up the original in a secure place.
3. Write down every step taken (e.g., “Copied hard drive using FTK Imager on May 5”).
**Chain of Custody
[USB Found] --> [Police Logs It] --> [Sealed in Bag] --> [Lab Opens It & Logs
Again]
|
Everyone records date/time & reason
Summary: Putting It All Together
Digital forensics is like solving a digital mystery. The steps are:
1. Identify what data/devices to look at
2. Preserve the evidence by making exact copies
3. Analyze the data for clues
4. Report everything clearly
Always keep a record of who handled the evidence (chain of custody), use the right tools,
and follow secure lab practices.
🛠️ Toolbox – What Forensics Experts Use
Tool What It Does Used For...
Autopsy Analyzes drives/phones, finds deleted Recovering evidence from
files devices
FTK Makes exact copies (bit-by-bit) Safe copying of data
Imager
Volatility Examines RAM (computer memory) Finds signs of hacking or
malware
