Home / Knowledge hub / Digital forensics
Knowledge hub
Digital forensics
Collecting and studying evidence from systems to learn what happened.
What it means
Digital forensics is the practice of collecting, preserving and examining data from computers, networks, phones and cloud services so you can say what happened, when and how. The data is treated as evidence, so the way it is handled matters as much as what it shows.
The usual sources are disk images, memory captures, logs, network records and account activity. The work is slow on purpose. Changing a system while you look at it can destroy the very evidence you came for. Careful handling comes first, and the analysis comes after it.
Why it matters
After an incident, the first questions are plain ones: what was taken, how long were they in, and are they still there? Guessing wrong is costly. Tell regulators too little and you face penalties. Tell customers too much and you cause alarm that was not needed.
Forensics gives answers you can defend. It may also be needed for an insurance claim, a legal case or a police report, and each of those can depend on whether the evidence was collected in a way that holds up. See chain of custody.
How it shows up
You meet forensics as an outside firm called after a breach, or as your own team pulling logs and images. RFC 3227 sets out the principle of collecting the most short-lived data first: memory and running processes before disk, and disk before archived backups.
The common mistakes are rebooting or wiping a machine too early, having logs that were never kept or are too short, and no timeline of who touched what. Decide ahead of time what you will record, where, and for how long. Good logging turns forensics from guesswork into reading.
Questions people ask
Digital forensics, answered
Is digital forensics the same as incident response?
No. Incident response is the whole effort to handle an incident: detect, contain, recover. Forensics is the evidence work inside it, focused on what happened and how.
They overlap, and the people involved often work together.
When should we call a forensics firm?
When the incident may have legal, regulatory or insurance consequences, when you cannot explain how the attacker got in, or when your own team lacks the skills.
Many cyber insurance policies name approved firms, so check yours before you need it.
Should we wipe the machine and start again?
Not before the evidence is saved. Rebuilding is often the right recovery step, but only after you have taken the images and logs that you need.
Short-lived data in memory is lost when a machine is powered off.
What logs help forensics most?
Authentication records, administrative actions, network and firewall logs, cloud activity logs and application request logs. Time needs to be accurate and consistent across them.
Logs held only on the affected machine are easy for an intruder to alter.
Can forensics prove who did it?
It can often show what happened, from which addresses and with which accounts. Naming the person behind the keyboard is much harder, because addresses and accounts can be borrowed.
Report what the evidence supports, and no more.
Related
Terms that sit next to this one
Chain of custody
A record of who handled evidence, so it can be trusted later.
Incident response
The agreed plan for the hours after something has gone wrong.
Log retention
How long you keep logs, which decides whether you can investigate old incidents.
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
Cyber insurance
Cover for costs after a cyber incident, usually conditional on controls being in place.
Will your logs answer the question?
Our findings record the request, the response and the code involved, which helps teams see how a flaw behaves and what an attacker would reach. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.