Branches of digital forensics: computer, mobile, email, cloud, database and more
In short: Digital forensics has several branches, each focused on a different evidence source: computers, memory, networks, mobile devices, email, cloud services, databases and malware. Most investigations combine several, so examiners need broad IT knowledge plus depth in one or two areas.
One discipline, many sources
Digital forensics started with seized computers, but evidence now lives in phones, cloud services, email systems and network logs. Each source has its own formats, tools and pitfalls, so the field has grown branches. Knowing them helps you understand who to call in an investigation and where to look for evidence you might otherwise miss.
The branches and their evidence
| Branch | Typical evidence | More detail |
|---|---|---|
| Computer (disk) | Files, deleted data, file system metadata, Windows artefacts | Disk forensics, Windows artefacts |
| Memory | Running processes, network connections, injected code | Memory forensics |
| Network | Packet captures, flow records, firewall and proxy logs | Network forensics |
| Mobile | Messages, call logs, location history, app data | Mobile forensics |
| Message headers, mailbox rules, sign-in records, attachments | Header analysis shows the true route a message took | |
| Cloud | Audit logs, sign-in logs, file activity, admin changes | Evidence is collected through provider tools and logs, not by imaging disks |
| Database | Transaction logs, audit tables, user permissions | Shows who changed which records and when |
| Malware | Suspicious files and their behaviour | Static and dynamic analysis in an isolated lab |
Other specialist areas include IoT and vehicle forensics, audio and video analysis and cryptocurrency tracing. They follow the same principles with different tools.
How branches combine
A single business email compromise might need email forensics to trace the phishing message, cloud forensics to read sign-in logs, mobile forensics if the victim approved an MFA prompt on their phone, and network logs to confirm where the attacker connected from. The examiner's job is to join these into one timeline. Strong investigators know which branch can answer which question, even when they call in a specialist to do the work.
Forensics as part of cyber security
Forensics is not only for courts. Security teams use the same branches every week to answer practical questions: did this phishing email lead to a sign-in, which machines did the malware reach, and was any data copied out? The answers decide whether a breach must be reported to a regulator and which systems need rebuilding. Good logging, time synchronisation and asset records, set up before an incident, make every branch faster and more reliable.
Skills and roles
Forensic work appears in police digital forensic units, consultancies, banks, large companies' incident response teams and managed security providers. Job titles include digital forensic analyst, DFIR consultant, eDiscovery specialist and malware analyst. Useful foundations are networking, operating systems and scripting, followed by forensic training and certifications from bodies such as GIAC or tool vendors. In some legal systems, examiners must also meet quality standards and may appear as expert witnesses, where clear, unbiased explanation matters as much as technical skill.
Real-world example: a fraud at a building supplier
A fictional building supplier finds that several invoices were paid to a new bank account. Email forensics shows the supplier's change-of-bank-details message came from a look-alike domain. Cloud forensics on the accounts mailbox shows a sign-in from an unfamiliar country and a new rule hiding replies from the real supplier. Database forensics on the finance system shows which user approved the change and when. Together the branches show that a phished mailbox, not an insider, caused the loss, which shapes the insurance claim and the fixes.
Practice
Why is cloud forensics usually done through logs rather than disk images?
Which branch would study message headers to find where an email really came from?
Why do investigators need to know several branches?
Key takeaways
- Digital forensics has branches for each kind of evidence source.
- Main branches: computer, memory, network, mobile, email, cloud, database and malware.
- Cloud evidence comes mostly from logs and provider tools.
- Most cases combine several branches into one timeline.
- Careers need solid IT foundations plus forensic method and clear reporting.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.