Digital Forensics Principles

Digital forensics is the discipline of identifying, preserving, analyzing, and presenting electronic evidence in a manner that is legally sound, whether for a criminal prosecution, a civil lawsuit, or an internal corporate investigation. It draws on principles from traditional forensic science but applies them to data: files, memory contents, network traffic, and the artifacts left behind by an operating system or application. The central challenge that distinguishes digital forensics from ordinary IT troubleshooting is that an investigator must be able to demonstrate, later and to a skeptical audience such as a court, that the evidence presented is authentic, complete, and has not been altered since it was collected.