Digital forensics is the discipline of determining the who, what, where, how and when of what took place on a digital system. Now that so much of our lives is spent online, so much information can be deciphered by digital forensics.
This section is designed to both assist the hacker to understand what evidence they leave behind and to train the digital forensic investigator of tomorrow. Digital forensic investigations are now part of nearly every crime investigation as nearly every perpetrator leaves a “digital signature” of their activities and intent.
Digital forensics is a VERY broad field covering many sub-disciplines such as network forensics, mobile forensics, malware forensics and so much more. We will try to cover all of it here, eventually.
Digital Forensics, Part 4: Finding Key Evidence in the Forensic Image In the previous articles in this series, we captured an forensic image of the suspect’s hard drive, we captured a forensic image of the suspect’s RAM and we had used Autopsy to recover deleted files from our first image. In this lab, we will…
Digital Forensics, Part 3: Recovering Deleted Files In the first two parts of this series, we captured a forensically sound image of the hard drive or other storage device and an image of the RAM. In this tutorial, we will recover any files deleted by the suspect. | Digital Forensics Digital forensics is the practice…
Digital Forensics, Part 2: Live Memory Acquisition and Analysis In some cases, the forensic investigator will need to grab an image of the live memory. Remember, RAM is volatile and once the system is turned off, any information in RAM will be likely lost. This information may include passwords, processes running, sockets open, clipboard contents,…
Digital Forensics, Part 1: Capturing a Forensically Sound Image Digital forensics is rapidly growing field of information security. The hacker needs to understand what evidence can be recovered and the security engineer needs to know how to find it. These skills are applicable to law enforcement, corporate investigations, network intrusions, malware analysis and incident response,…