Digital forensics
Acquiring and analysing digital evidence, chain of custody, expert reports and method.
Browser Forensics: History, Cache and Cookies Explained
What a browser stores and how it is analysed forensically: history, downloads, cache, cookies, saved forms and passwords, private browsing and sync.
Chain of Custody for Digital Evidence: How to Document It
Chain of custody for digital evidence in practice: what to record, how to label exhibits, how to handle transfers and how to avoid avoidable challenges.
Cloud Forensics: Acquiring Evidence from Online Accounts
How evidence is acquired from cloud services and online accounts: official exports, activity logs, file versions, and issues of access and jurisdiction.
Forensic Analysis of a Compromised Website: Where to Start
How to analyse a compromised website such as WordPress: copying files, database and logs, modified files, suspicious accounts and finding the entry point.
Deleted File Recovery and File Carving: How It Works
Why deleted files can often be recovered, how file system recovery and file carving work, and when data is really lost: SSDs, overwriting and encryption.
The Digital Forensics Expert: Role, Engagement and Method
What a digital forensics expert does, court-appointed versus party experts, how an engagement is set up and how to work effectively with the lawyer.
Email Forensic Analysis: How to Read Email Headers
How to read email headers to verify origin and authenticity: Received fields, Message-ID, SPF, DKIM, DMARC and the warning signs of a forged message.
Encrypted Drives in Forensic Investigations: BitLocker and More
How disk and device encryption changes digital forensics: BitLocker, FileVault, recovery keys, acquisition from running systems and the legitimate limits.
Photo and Document Metadata: What It Reveals in an Analysis
What metadata photos, Office files and PDFs contain, how to read it in a forensic analysis, how reliable it is and why file system dates can mislead.
First Steps After a Cyber Incident: Preserving the Evidence
What to do in the first hours after a cyber attack without destroying evidence: containment, what not to switch off, what to record, recovery and analysis.
Forensic Capture of Web Pages and Social Media: Beyond Screenshots
How to reliably document web pages, posts and social profiles: why a screenshot is not enough, what to save and how to record context, date and address.
Forensic Disk Imaging: Bit-Stream Copies and Write Blockers
How a forensic disk image is made: how it differs from a normal copy, using a write blocker, image formats, hash verification and the issues with SSDs.
Forensic Timelines: Reconstructing Events from Digital Data
How a forensic timeline is built: sources of dates and times, time zones, normalisation, super timelines and how to read sequences of events correctly.
Hash Functions and Digital Evidence Integrity: A Practical Guide
What hash functions are, why MD5 and SHA-1 are no longer enough, how SHA-256 proves the integrity of digital evidence and which mistakes to avoid.
Memory Forensics: What RAM Analysis Reveals and When to Use It
Why RAM should be acquired before shutting a system down, what it contains, how it is analysed and what precautions a live acquisition requires.
Open Source Digital Forensics Tools: An Overview
The main open source digital forensics tools for acquisition, disks, memory, timelines and networks, with criteria for choosing and validating them.
OSINT and Digital Forensics: Open Source Investigations
What OSINT is and how to run verifiable, lawful open source investigations: useful sources, documenting results and avoiding attribution errors.
Recognising Anti-Forensic Techniques: Signs of Concealment
How an analyst recognises attempts to hide or destroy digital evidence: secure deletion, altered timestamps, cleared logs and recently reinstalled systems.
Server and Network Log Analysis for Forensics: A Practical Method
How to use web server, firewall, router and online service logs in an investigation: what to keep, how to read it, correlating IPs and times, IP limits.
Smartphone Forensic Analysis: Extraction Types and Limits
How a smartphone is examined forensically: network isolation, logical, file system and physical extraction, recoverable data and current limits.
USB Device Forensic Traces: Proving a Connection
How USB stick and drive use on a computer is reconstructed: identifiers, connection dates, drive letters, opened files and the limits of conclusions.
What Is Digital Forensics: Definition, Phases and Fields
What digital forensics is, what it is for and how it works: identification, acquisition, analysis and reporting, with practical examples and fields of use.
WhatsApp Chats as Evidence: How to Preserve Them Properly
How to preserve WhatsApp chats and other messages for use as evidence: limits of screenshots and exports, phone acquisition and verifying authenticity.
Windows Forensic Artifacts: Registry, Prefetch and Event Logs
The main Windows forensic artifacts: registry, Prefetch, event logs, LNK files, Jump Lists and ShellBags, what each one proves and how to read it.
How to Write a Clear and Robust Digital Forensics Report
Structure and rules for a digital forensics report: questions, method, findings, limits, attachments and language non-technical readers can follow.