Cyber Security
Digital Forensics
Collecting and analysing evidence from systems and networks.
- 10 notes
- 81 minutes of reading
- Digital forensics principles: integrity, chain of custody and admissibilityThe core rules of digital forensics: protecting evidence integrity with hashing, recording chain of custody, keeping good notes and making sure findings can stand up in a disciplinary hearing or court. 8 min · Beginner
- Order of volatility and live response: what to collect firstWhy some evidence disappears in seconds while other evidence lasts for years, the order of volatility from RFC 3227, and how to carry out a careful live response on a running system. 7 min · Intermediate
- Disk forensics: imaging, write blockers, hashing and deleted filesHow to make a forensically sound copy of a drive using write blockers and hashing, which image formats to choose, how file systems store data, and why deleted files can often be recovered. 9 min · Intermediate
- Memory forensics: why RAM matters and what you can findWhy random access memory (RAM) is so valuable to investigators, what evidence a memory image can reveal, how memory is captured, and how tools such as Volatility are used at a concept level. 8 min · Advanced
- Network forensics: packet captures, flow data and logsHow investigators use full packet captures, NetFlow and IPFIX records, and firewall, proxy and DNS logs to reconstruct what happened on a network, with examples of tools and filters. 8 min · Intermediate
- Windows forensic artefacts and building a timelineThe Windows artefacts investigators rely on, including event logs, registry hives, prefetch, Amcache, browser history and file system journals, and how to combine them into a timeline of activity. 10 min · Advanced
- The digital forensic investigation process: from identification to reportThe stages of a digital forensic investigation, identification, preservation, collection, examination and analysis, and reporting, with how they differ between incident response and HR or legal cases. 8 min · Beginner
- Branches of digital forensics: computer, mobile, email, cloud, database and moreAn overview of the main branches of digital forensics, including computer, memory, network, mobile, email, cloud, database and malware forensics, with typical evidence for each and the skills and roles involved. 7 min · Beginner
- Mobile device forensics: isolation, acquisition and the challenge of encryptionHow investigators handle smartphones as evidence: isolating them from networks, the levels of acquisition from manual to physical, the impact of encryption and locked devices, cloud backups and the key artefacts phones hold. 8 min · Intermediate
- Forensic tools and modern challenges: encryption, cloud, volume and anti-forensicsThe main categories of digital forensic tool, with well-known free and commercial examples, and the big challenges facing examiners today: encryption, cloud data, huge volumes, anti-forensic techniques and validating tools. 8 min · Intermediate