Digital Forensics
Learning outcomes:
- Explain what computer forensics is, and where it's used
- Identify types of digital evidence, including volatile data
- Describe the steps of an investigation, including making a forensically sound copy
- Describe how a CERT or CSIRT handles an incident and what happens after it
Would you like to download my PowerPoint to follow along?
- What is computer forensics?
- Forensics for computers and digital storage media
- The goal is to examine evidence in a forensically sound manner
- Used in criminal law since the mid 1980s
- NIST's guide to integrating forensic techniques into incident response
- Where it's used
- Criminal investigations
- Civil court cases
- Corporate IT
- Careers in computer forensics
- Police and law enforcement
- Government agencies
- Audit and compliance services
- Corporate IT
- Digital evidence types
- Disk drives and secondary storage
- Cell phones
- Other: printers, game systems, security alarms, and IoT
- Volatile data, which is lost when the power goes off
- Steps of an investigation
- Identify, collect, and preserve evidence
- Evidence analysis
- Reporting and testimony
- Duplication and authentication
- A forensically correct copy: a drive image, bit stream image, or ISO image
- Write blockers, and special software and hardware for duplication
- Forensically wiped drives
- Hashes to prove the copy matches the original
- CERT and CSIRT teams
- Dealing with an incident
- Team members, including stakeholders and the C-suite
- Prioritizing: shut it all down, or work around it?
- After an incident
- Identify and preserve evidence: forensic copies, logs, and histories
- Analysis: what happened, why, damage control, and data loss
- Reports and documentation
- Prevention: changes to structure, policy, or personnel
- Example: after its July 2026 breach, Hugging Face published a post-mortem covering what happened, when, what was accessed, and what it changed (Cloud Security Alliance)
Suggested Activities and Discussion Topics:
- Discussion: what devices in your home could hold digital evidence?
- Discussion: why does a forensic investigator work from a copy instead of the original drive?
- Activity: look up a court case that used digital evidence. What kind of evidence was it, and how was it collected?
- Follow the instructions on this PDF (accessible HTML version)
Would you like to see some more classes? View all classes