Introduction to Digital Forensics – Part 1/2

There are Four main principles involved that you need to keep in mind:

  1. No action taken by law enforcement agencies or their agents should change data held on a computer or storage media, which subsequently might be relied on in court.
  2. Only in exceptional circumstances, a person finds it necessary to access original data held on a computer or storage media must be competent to do so; and be able to give evidence explaining the relevance and the implications of their actions.
  3. An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. Note: an independent third party should be able to examine those processes and achieve the same result.
  4. The person in charge of the investigation is responsible for ensuring that the law and these principles are adhered to.


Below are some unique characteristics of the digital evidence:

  • The evidence is invisible to the untrained eye – Electronic evidence is often retrieved from places known or accessible only to experts.
  • Sometimes, it might need to be interpreted by a specialist – In many cases information gained requires thorough analysis to uncover properties assuring the information is valid from judicial point of view.
  • The evidence is highly volatile – A powered electronic device modifies its state every time a specific event Also, lack of power or a system overwriting old data with new data requires us to preserve electronic evidence as soon as possible.
  • The evidence might be altered or destroyed through normal use – Devices constantly change the state of memory – allocating it for programs automatically, swapping it to disk or writing chunks of it to a disk file on user request.
  • It can be copied without limits – This property allows many specialists work on the same evidence at the same time in different places. It also enables the possibility of presenting the evidence as-is in the court of law along with the specialist witness report.


In conclusion, computer forensic is a process of reveal the found evidence either by criminal and civil proceedings. Digital evidence can be used by different departments such as, Criminal justice agencies, Corporate Councils, Insurance Companies, Law Enforcement Officials, Company Legal resources, Human Resources department, Auditors, Individuals, Crackers or Hackers and many more.


Computer Forensics

Computer forensics is the application of computer investigation and analysis techniques in the interests of determining potential legal evidence.

The forensic term can be used in many different areas in where they all agree with the forensic term (the theory behind the investigation and analysis), but they are differ in the final outcome. For example, Dentistry Forensic, Archaeology Forensic, Accounting Forensic, Graphology Forensic, Medicine Forensic, Digital Forensic, Network Forensic, Pathology Forensic, Psychology Forensic, Science Forensic, Toxicology Forensic and more. However, I will be focusing on the Digital and Network Forensics, where you can learn the forensic fundamental basis, forensic methodology, Windows forensic, iOS forensic, mobile phone forensic, network forensic; along with the ability to interact with LINUX System.


The question is “Who Does the Computer Forensic Analysis?

The answer that many people might think of or will come up with is the Police. However, that is not necessary correct nowadays, because more and more companies now realise that they need “in-houseForensics employees as first response to possible, intrusion and malicious intent.


Several facts about the Digital Forensic:

  1. Digital Forensic is not a proactive security, but a reactive scene to an event or request.
  2. Digital Forensic is not about finding the bad guys, but about finding evidences that might be very of valuable.
  3. Digital Forensic is not something you do for fun, but it requires some expertise.
  4. Digital Forensic is not something can be done quickly, but it takes some time to find any malicious activity.

Note: Multi TeraByte drives are becoming available. Thus, it is getting harder and becoming very difficult to find the result. Just imagine the time takes from you when you are looking for specific sheet between more than 5000 sheets. The PowerPoint file explains this in details (Digital Forensics):


In conclusion, Digital Forensic id not CSI (Crime Scene Investigation), but it is more likely to be gathering electronic evidences in the crime scene and analyse them to find any malicious or misuse activities.