Computer Forensics

What it is and why it matters

A computer records far more than its owner realises. Every file opened, every USB stick plugged in, every program run and every website visited leaves marks in the file system, the registry and the logs. Computer forensics is the discipline of collecting those marks without altering them, reading them correctly and explaining them in plain language to the people who will decide a case.

The work has two halves. The first is acquisition, where the examiner makes an exact copy of the storage and proves it is exact with a cryptographic hash. The second is analysis, where the copy is searched, deleted material is recovered and events are placed on a timeline. Both halves are documented so that another examiner could repeat them and reach the same result.

It matters because computers sit at the centre of most disputes today. A fraud leaves spreadsheets and emails. A data theft leaves USB connection records and cloud sync logs. A harassment case leaves browser history and chat databases. The examiner's job is to turn these traces into facts that can be tested.

Types of digital evidence

File System Metadata
Names, sizes, timestamps and allocation records such as the NTFS $MFT, which show when a file was created, changed and last written and whether it still exists.
Deleted and Unallocated Data
Content the file system no longer points to but has not yet overwritten. It is recovered from unallocated clusters and from the slack at the end of allocated files.
Registry and Configuration
Windows registry hives, macOS property lists and Linux configuration files record user accounts, installed software, connected devices and recently used items.
Logs
Windows Event Logs, Linux journald and syslog, macOS unified logs and application logs that record logons, service starts, errors and shutdowns with timestamps.
User Activity Artefacts
Shortcut (LNK) files, jump lists, shellbags, prefetch files and browser history that show what a person opened, ran and visited.
Communications
Email stores such as PST, OST and mbox files, chat application databases and the attachments that travelled with them.
Volatile Memory
The contents of RAM at the time of seizure, which can hold passwords, encryption keys, running processes and network connections that never reach the disk.
Backups and Shadow Copies
Volume Shadow Copies, Time Machine snapshots and backup files that preserve earlier versions of files the user later changed or deleted.

Devices and data sources

Internal hard drives and SSDs in desktops, laptops and servers
External USB drives, pen drives and memory cards
RAM captured from a running machine
Optical discs and older removable media still found in offices
Virtual machine disk files such as VMDK, VHDX and QCOW2
Cloud sync folders for OneDrive, Google Drive and Dropbox and their local databases
Printers, routers and network shares the computer connected to
System and application backups kept on other media or servers

How an examination runs

The order matters. Each step protects the one after it.

01
Authorisation and Scope
Confirm the legal basis for the examination, who owns the device and what questions the examiner is asked to answer. Write the scope down before touching anything.
02
Scene Documentation
Photograph the computer, its cables, screen and surroundings. Record make, model and serial numbers. Note whether it is on, asleep or off.
03
Live Decisions
If the machine is running, decide whether to capture RAM and check for full disk encryption before shutting down. Pulling the plug on an encrypted laptop can lock the data away for good.
04
Write-Blocked Acquisition
Remove or connect the storage through a hardware write-blocker and create a bitstream image in raw or E01 format. Hash the source and the image and record both values.
05
Verification
Compare the hashes, confirm the image opens and store the original in sealed evidence storage. All further work is done on copies.
06
Analysis
Parse the file system, recover deleted material, read registry and logs, build a timeline and answer the scoped questions. Keep notes of every tool, version and setting used.
07
Reporting
Write a report that separates what was found from what it means, states the limits of the method and lets a reader follow each conclusion back to the evidence.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Bitstream Image: A sector-by-sector copy of a storage device that includes unallocated space and slack, not just the visible files.
Hash Value: A fixed-length fingerprint such as SHA-256 computed from data. A single changed bit changes the hash, which is how examiners prove a copy is exact.
Write-Blocker: A hardware or software control that lets the examiner read a device while stopping every write command from reaching it.
Unallocated Space: Clusters the file system marks as free. They often still hold the content of deleted files until something overwrites them.
Slack Space: The unused part of the last cluster of a file, which can hold fragments of whatever occupied that cluster before.
File Carving: Recovering files from raw data by their header and footer signatures when no file system record points to them.
Timeline: A single ordered list of events drawn from file timestamps, logs, registry and browser records so that the sequence of actions can be seen.
Triage: A quick first look at a device to decide whether it holds relevant material and how urgently it needs a full examination.
Chain of Custody: The documented record of who held an item of evidence, when and why, from seizure to court.

Challenges and limits

What makes it hard

Full disk encryption such as BitLocker and FileVault makes an image useless without the recovery key or a live capture of the unlocked system
Multi-terabyte drives and many devices per case stretch imaging time and storage
SSDs can erase deleted data on their own through TRIM and garbage collection, so recovery expectations must be lowered
More user data lives in cloud accounts than on the device, and reaching it needs separate legal authority
Anti-forensic tools can wipe free space, alter timestamps and clear logs, so the examiner looks for signs of that activity as well
Clock errors, time zones and daylight saving must be resolved before any timeline is trusted
Tools have bugs and gaps, so important findings are checked with a second tool or by hand

Keeping the evidence intact

Use a tested write-blocker for every acquisition and record its make, model and firmware
Hash the source and the image with at least one strong algorithm, record both values and verify again before analysis
Keep the original sealed and work only on verified copies
Write contemporaneous notes with dates, times, tool versions and the reason for every step that departs from normal procedure
Log every person who handled the evidence and every transfer in the chain of custody record

Standards and legal considerations

ISO/IEC 27037:2012
Guidelines for identification, collection, acquisition and preservation of digital evidence. The reference for how a seizure and an imaging should be carried out.
Read the guide
NIST SP 800-86
Guide to Integrating Forensic Techniques into Incident Response. Sets out the collection, examination, analysis and reporting phases used on this page.
Read the guide
SWGDE Best Practices
Practical documents from the Scientific Working Group on Digital Evidence on computer forensic acquisition, examination and reporting.
Read the guide
Digital Evidence Lifecycle
How identification, collection, examination, analysis, presentation and disposal fit together and what each stage demands.
Read the guide

In practice

Files Copied Before Resignation
A company suspects a departing engineer copied design files. The examiner images the laptop, reads the USBSTOR registry key and the setupapi log to list every USB device ever connected, then matches LNK files and shellbags to folder names on a removable drive during the engineer's last week.
A Backdated Document
A contract PDF claims to be two years old. The $MFT shows the file was created last month, the PDF metadata names a software version that did not exist on the claimed date and a Volume Shadow Copy from six weeks ago does not contain the file.
An Encrypted Laptop at the Scene
A running laptop shows a BitLocker-protected volume. The team captures RAM and documents the open session before an orderly shutdown, which keeps the chance of recovering the volume key instead of losing the data to encryption.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.IntermediateDCFA

StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.IntermediateDCFA

LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.IntermediateDCFA

Standards for this area

Careers that use it

Questions people ask

Does turning on a computer destroy evidence?

It changes things. Booting writes to logs, updates timestamps and can trigger updates or cloud sync. That is why examiners image the storage through a write-blocker instead of booting the original. A machine that is already running is a different case, where the volatile data may be worth more than the risk.

Can deleted files always be recovered?

No. Recovery depends on whether the clusters have been reused, whether the drive is an SSD that has already trimmed them and whether the data was encrypted. The examiner reports what was recovered and what could not be.

What is the difference between computer forensics and data recovery?

Data recovery aims to get files back for their owner. Computer forensics aims to find out what happened and to prove it, with documentation and integrity controls that make the result usable as evidence.

How long does an examination take?

It depends on the size of the storage, the state of the device and the questions asked. Imaging alone can take hours for a large drive. DFRTI does not quote fixed times because every case is different.