Digital forensics, discipline by discipline
Every discipline on one page each: what the evidence is, where it hides, how an examiner gets it out without changing it, the tools, the words and the places where the method stops.
39 disciplines7 groupsFree to readSources on every page
Digital forensics is one method applied to many kinds of device. The method is always the same: identify the evidence, get authority to touch it, preserve it, copy it in a way that can be proved exact, examine the copy, analyse what it shows, write it down and present it so a court or an employer can test it. What changes from discipline to discipline is where the evidence lives, what can alter it and which tools can read it.
These pages are written for people who are learning the field, for investigators who need to know what a laboratory can and cannot do and for lawyers and managers who have to read a forensic report. Each page is checked against published standards and official documentation and carries the date it was last reviewed. They introduce the subject properly. The courses teach it on real devices.
Devices and storage
Computers, phones, SIM cards, chips, HDD, SSD, RAID and recovery
- Computer ForensicsComputer forensics is the examination of desktops, laptops and servers to find out what happened on them, done in a way that a court or an employer can trust.
- Mobile Device ForensicsMobile device forensics recovers and interprets data from phones and tablets, the devices that now hold more about a person's day than any computer does.
- SIM Card ForensicsSIM card forensics reads the small smart card that links a phone to a subscriber, recovering identifiers, stored contacts, messages and the last network the card saw.
- Chip-Off and Hardware ForensicsHardware forensics reaches the memory chip directly when the device cannot be read through its normal interface. It is powerful, destructive and used only where the law and the case justify it.
- SSD and NVMe ForensicsSolid-state drives store data in flash and manage it with a controller that moves, erases and hides data on its own. That changes what an examiner can promise.
- HDD ForensicsThe hard disk drive is still the most common item in an evidence store. Its mechanics are old, but the rules for imaging it exactly and finding what it hides are the foundation of storage forensics.
- RAID and NAS ForensicsA RAID set or a NAS box spreads data across several disks. The examiner images each one, rebuilds the array virtually and then reads the file system and the appliance's own records.
- Data Recovery and Evidence RecoveryData recovery gets files back for their owner. Evidence recovery does the same job under forensic controls, so that every recovered item can be traced to its origin and defended.
Operating systems
Windows, Linux, macOS, Android and iOS artefacts
- Windows ForensicsWindows keeps a record of almost everything a user and the system do, scattered across the registry, the event logs and the file system. Windows forensics is the skill of knowing where each record lives and what it can and cannot prove.
- Linux ForensicsLinux runs most servers, cloud instances and network appliances, so it is where intrusions, data breaches and web fraud usually leave their first marks. Linux forensics reads a system that keeps its records in plain files and expects the examiner to know where they are.
- macOS ForensicsA Mac is a Unix system with Apple's file system, security chip and logging on top. macOS forensics means reading APFS, the unified log and hundreds of property lists, inside the limits that FileVault and Apple silicon now set.
- Android ForensicsAndroid runs on most phones in India, from budget handsets to flagships, in hundreds of hardware variants. Android forensics is about getting as much of the userdata partition as the device lawfully allows and then reading the app databases inside it.
- iOS ForensicsiPhones hold a tightly controlled file system behind one of the strongest consumer encryption designs in use. iOS forensics works within that design, taking the fullest lawful extraction the device allows and reading the databases Apple and its apps leave behind.
Networks and cloud
Traffic, cloud accounts, email, browsers, databases and apps
- Network ForensicsNetwork forensics studies the traffic between machines, in packets, flow records and the logs of the devices that carried it, to find out who talked to whom, when and what passed between them.
- Cloud ForensicsCloud forensics gathers evidence from systems an organisation rents rather than owns, where the provider holds the hardware and the examiner works through logs, snapshots and lawful requests.
- Email ForensicsEmail forensics examines messages, mailboxes and mail server records to establish who sent a message, which path it took, whether it was altered and what it carried.
- Browser ForensicsBrowser forensics reads the databases, caches and session files a web browser keeps, to show which sites a person visited, what they searched for, what they downloaded and when.
- Database ForensicsDatabase forensics examines the files, logs and audit records of a database to show what data existed, who changed it and whether deleted or altered rows can be recovered.
- Social Media and Messaging Application ForensicsSocial media and messaging forensics recovers and verifies conversations, posts and account activity from devices, backups, public pages and provider records, within the limits that encryption and the law set.
- Cloud Collaboration and Enterprise Application ForensicsEnterprise application forensics works inside the collaboration suites and business systems an organisation runs, using their audit logs, holds and exports to show who did what to which document, message or record.
Multimedia and surveillance
CCTV, video, audio, images and synthetic media
- CCTV and DVR ForensicsCCTV and DVR forensics is the retrieval and examination of recordings from surveillance recorders, where the first job is to get the original footage out before the system writes over it.
- Video ForensicsVideo forensics examines recorded video to answer specific questions about what it shows, how it was made and whether it has been changed, with each of those questions handled as separate work.
- Audio ForensicsAudio forensics examines recorded sound, usually speech, to make it intelligible, to test whether a recording has been altered and to compare voices, each with its own method and its own honest limits.
- Image ForensicsImage forensics examines still images to find out where they came from, whether they have been changed and what they genuinely show, using the file's structure and the picture's own physics as well as its metadata.
- Multimedia ForensicsMultimedia forensics covers image, video and audio evidence together, with the containers they travel in, the apps and platforms that reshape them and the methods used to show where a copy came from.
- Deepfake and Synthetic Media ForensicsDeepfake and synthetic media forensics examines images, video and audio that may have been generated or altered by machine learning. It combines trained examination, detection software, provenance data and context and reports the uncertainty that remains.
Memory, malware and incident response
RAM, malicious code and how a breach is handled
- Memory ForensicsRAM holds what a computer is doing right now: the processes, connections, keys and decrypted data that never reach the disk. Memory forensics captures that moment and reads it after the fact.
- Malware ForensicsMalware forensics works out what a malicious program did on a system and how it got there, by examining the code itself and the traces it left. It is part forensic examination and part reverse engineering, done safely and under control.
- Digital Incident ResponseIncident response is what an organisation does when a security breach is under way: stopping the damage, finding out what happened and getting back to work, while keeping the evidence that will be needed afterwards.
Emerging and specialised
Drones, IoT, vehicles, location, crypto and AI
- Drone and UAV ForensicsDrone forensics recovers where an unmanned aircraft flew, what it recorded and who was flying it, from the aircraft, its controller, the pilot's phone and the accounts behind them.
- IoT ForensicsIoT forensics gathers evidence from the small connected devices in homes, offices and factories, most of which keep their real records somewhere other than on the device itself.
- Vehicle and Automotive ForensicsA modern car is a network of computers that records where it went, what it was doing in the seconds before a crash and which phones were plugged in or paired.
- GPS and Location ForensicsLocation forensics brings together every record of where a device was, from satellite fixes to cell towers and Wi-Fi networks, and says plainly how far each one can be trusted.
- Cryptocurrency and Blockchain ForensicsCryptocurrency forensics follows money across public ledgers and recovers the wallet evidence on seized devices, in cases from investment fraud and ransomware to extortion and laundering.
- AI-Assisted Digital InvestigationsAI-assisted investigation uses machine learning to sort, label, transcribe and summarise evidence faster than a person can, while leaving every finding to be checked by a human examiner.
Evidence, law and practice
Preservation, integrity, reporting and the courtroom
- eDiscovery and Corporate InvestigationseDiscovery is the disciplined way an organisation finds, preserves, reviews and hands over its electronic records for a dispute, a regulator or an internal inquiry.
- Digital Evidence ManagementDigital evidence management is the system of records, storage and controls that lets a laboratory say exactly where an exhibit has been, who touched it and why, at any moment from seizure to disposal.
- Digital Evidence Presentation and ReportingA forensic examination ends in a document and sometimes in a witness box. Presentation and reporting is the craft of making technical findings clear, complete and honest for readers who were not in the laboratory.
- Digital Evidence PreservationPreservation is the set of actions that stop digital evidence from changing between the moment it is identified and the moment it is examined, together with the records that show it did not change.
One lifecycle under every discipline
Whatever the device, the evidence passes through the same twelve stages. Each one protects the next. Skip one and everything after it can be challenged.
- 01Identification
- 02Authority and Scope
- 03Preservation
- 04Collection
- 05Acquisition
- 06Examination
- 07Analysis
- 08Documentation
- 09Reporting
- 10Presentation
- 11Retention
- 12Secure Disposal
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.