Introduction to Digital Forensics

What forensics is for

Forensic analysts reconstruct what happened on a system: after a breach, an insider incident or in a legal matter. Results must be repeatable and defensible, so process matters as much as tools.

Core principles

• Preserve evidence: do not alter the original; work on forensic copies.
• Document every action and keep a chain of custody: who handled the evidence, when and why.
• Verify integrity with cryptographic hashes (for example SHA-256) before and after copying.
• Order of volatility: collect fast-disappearing data first (RFC 3227): memory, then network state, running processes, disk, logs and backups.

Typical phases

1. Identification and scoping
2. Collection and acquisition (disk image, memory dump)
3. Examination and analysis
4. Reporting

What analysts look at

Beginner-friendly tools

Autopsy (disk analysis GUI), ExifTool (metadata), Volatility 3 (memory), and binwalk (file carving).

Try it safely

Our synthetic forensics challenges need no real evidence: Metadata Detective and Carve It. Only analyse data you are authorised to handle.

Hash an evidence file

sha256sum evidence.img

Record the hash in your notes; recompute it later to prove the file did not change.