Digital Forensics · Visual IT Encyclopedia

Definition

A scientific investigation technique used to establish the facts of an incident by lawfully collecting and preserving digital evidence, verifying its integrity, and analyzing and reporting findings

Principles

Digital evidenceEstablish trust

LegitimacyUse lawful authority
and follow due process

TimelinessConsider loss risks;
preserve promptly

IntegrityPreserve the original;
check for changes

Chain of custodyTrack all handling from
collection to reporting

ReproducibilityUse the same conditions
to reproduce the result

Process

All five principles apply throughout the process

PrepareAuthority and scope
AcquireCollect and preserve
TransferProtect and hand over
AnalyzeExamine and verify
ReportEvidence, conclusions, limits

Comparing hashes of an original and its copy checks whether the data match. That comparison alone cannot establish whether tampering occurred before collection.