Chapter 12
Digital Forensics

Digital forensics is the process of gathering and submitting computer evidence to trial and interpreting that evidence by providing expert analysis. A forensic analyst (also called: forensic computer examiner, digital forensic examiner, computer forensic detective) uses specialized tools and skills to recover information from computer systems, memory, and storage.

All forensic work must follow written procedures. Deviating from written procedures gives defense attorneys grounds to challenge and exclude evidence. Every step must be documented, repeatable, and performed without bias.

The four-step forensic process

Three ethics requirements

Legal hold

A legal hold is a process designed to preserve all relevant information when litigation is reasonably anticipated. The moment a legal hold is issued, no evidence may be destroyed or modified — even if routine data deletion policies would normally apply. Violations of a legal hold can result in sanctions, adverse judgements, or criminal contempt. A legal hold can also result in physical servers being seized as evidence for the entire duration of a trial — potentially months or years. Business continuity plans must account for this possibility.

Work product retention is a contractual mechanism for hiring a forensic investigator such that their analysis is protected from disclosure by the work product doctrine. This protects the analytical findings from being handed over to the opposing party during discovery.

Evidence must be collected in order of volatility — most volatile first. The moment power is removed, everything in memory is gone forever. A forensic analyst arriving at a live scene must make rapid decisions about collection order based on this hierarchy.

Authorization before collection

Forensic evidence cannot be collected with a simple file copy — specialized tools are required to ensure the acquisition is forensically sound (bit-by-bit, with integrity verification). Three tools are specifically covered in the CySA+ curriculum.

Forensic workstation requirements

System memory must be collected early — it contains running processes, cryptographic keys, registry data, open file contents, network connections, and password hashes. All of this is lost the moment power is removed.

What memory analysis can reveal

Three acquisition methods

Physical vs. logical acquisition

Write blockers

A write blocker prevents the forensic workstation from writing anything to the evidence drive during acquisition. Without one, simply connecting the drive to a PC can modify metadata, timestamps, and access records. Hardware write blockers (e.g. Tableau forensic USB bridge) are strongly preferred over software — hardware solutions are foolproof; software can be circumvented.

The dd command — disk duplication

Image file formats

A hash is a digital fingerprint — a fixed-length output produced by running data of any size through a cryptographic function. The same input always produces the same hash. Even a single changed bit produces a completely different hash. This makes hashing the foundation of digital forensic integrity verification.

Hash algorithm comparison

Hash verification — what it looks like

File Integrity Monitoring (FIM)

Hashing is also used proactively on live systems through File Integrity Monitoring software. FIM maintains a database of approved hash values for operating system and application files (published by vendors like Microsoft). When a file's hash no longer matches the approved value, an alert fires — indicating tampering, rootkit installation, or malware modification of system files.

Windows utilities: CertUtil (built-in) and FCIV (File Checksum Integrity Verifier, downloadable). Linux: md5sum, sha1sum, sha256sum, sha512sum.

A forensic timeline shows the sequence of file system events within a source image in a graphical format — who touched which files, when, and in what order. It is one of the most powerful ways to present digital evidence in a report or in court.

Without a timeline, file access events are isolated data points. With a timeline, you can demonstrate that the suspect was active on the system at a specific time, that specific files were accessed in a specific sequence, and that this sequence matches a known attack pattern.

What a timeline helps answer

Timeline tools

When a file is "deleted," its data is not actually erased from the disk. Only the reference entry in the file system table (the Master File Table in NTFS, or the File Allocation Table in FAT) is removed. The actual data blocks remain on disk — marked as "free space" available for future writes. Until those blocks are overwritten, the data can be recovered.

How disk storage works (why deletion doesn't erase)

File carving

File carving is the process of extracting data from a disk when the file system metadata no longer points to it. The carving engine scans the raw disk for file signatures (magic bytes) — the known header bytes that identify file types (e.g. PDF files start with %PDF, JPEG with FF D8 FF, ZIP with PK). It then extracts all data from that header through to the likely end of the file.

The chain of custody is the complete record of evidence history from the moment of collection through presentation in court to final disposal. Every person who touches the evidence, every location it moves to, and every action performed on it must be recorded. Any gap in the chain of custody can result in evidence being declared inadmissible.

Evidence handling procedures

Specialized evidence bags

Evidence metadata — what to record

Every piece of evidence must be self-describing. Record: unique identifier, description of contents, why it is relevant, and a precise date/time stamp. Recommended format: YYYY-MM-DD HH:MM — unambiguous, sortable, and internationally readable. This metadata is how you find a specific piece of evidence in a room full of boxes months or years later when the court date finally arrives.