Stop 08 · Incident Response & Digital ForensicsTopics · 4/9

Digital Forensics Fundamentals

In short

After an attack, the machine holds the story of what happened. Forensics is reading that story carefully, without smudging the very evidence you need.

The practice of collecting, preserving, and analyzing digital evidence in a way that maintains its integrity — essential both for incident investigation and, in some cases, for legal proceedings.

The blob in gloves photographs and bags evidence at a tidy desk crime scene.

Think of it like this

The careful crime scene officer

A good officer at a scene does not trample footprints or move the furniture. They photograph, label and bag each item before touching anything else. Digital forensics is that discipline for computers: preserve first, examine second, and never alter the original.

Watch it happen

The forensic process

Preserve

Acquire

Analyse

Report

1/4Protect the original. Do not keep using the machine; every action changes the evidence.

The big ideas

What you need to know

Preserve the original

Every click changes a disk. Work on a copy so the original stays pristine for later checks or court.

Hashes prove integrity

A hash of the image acts like a seal. If it still matches later, you can prove nothing was altered.

Work on the copy

Never investigate the live original. Analyse the verified image, so the evidence stays trustworthy.

Order of volatility

Some data vanishes fast, like memory, and some lasts, like disk. Capture the fragile things first.

See it in code

Walk through the code

bash

1# On a lab machine YOU own: make a verified disk image2# Create a read-only, bit-for-bit copy of the evidence disk3dd if=/dev/sdb of=evidence.img bs=4M conv=noerror,sync status=progress4 5# Record a hash so you can prove the image never changed6sha256sum evidence.img > evidence.img.sha2567cat evidence.img.sha256

1/3dd copies the whole disk block by block into an image file you then analyse instead of the original.

Only ever image a disk you own or are authorised to examine. The hash is your proof of integrity, checked again at every handover.

Save yourself the pain

Common mistakes

Oops

Investigating directly on the live, original machine.

Do this instead

That changes the evidence. Image the disk, verify the hash, and analyse the copy instead.

Oops

Forgetting to hash the image at capture time.

Do this instead

Without an early hash you cannot prove the data is unchanged. Hash at capture and re-check at every step.

Your mission

Image a USB you own

~40 min

Quick check

Why do forensic analysts work on a copy rather than the original disk?

Go deeper

1Read a conceptual overview of the digital forensics process: identify, preserve, analyze, report.
2Learn why forensic soundness (not altering evidence) is critical even in a purely internal investigation.
3Understand the difference between live forensics (on a running system) and dead-box forensics (offline).