Digital forensics is the discipline concerned with identifying, preserving, analysing and presenting digital data so that it can be used as evidence. It is not only about cybercrime: today almost every dispute, from an employment conflict to a divorce case, leaves traces on phones, computers, mailboxes and online services. The forensic examiner's job is to turn those traces into reliable elements that anyone can verify and that are hard to challenge.
Why you need a method, not just a technician
Anyone who can use a computer can open a folder and copy some files. What separates a simple copy from evidence is method. Digital data changes very easily: opening a document can update its last-access date, switching on a phone can trigger synchronisations that overwrite messages, and plugging a drive into Windows lets the system write indexing files to it.
That is why digital forensics rests on a few constant principles:
- do not alter the original, working on faithful copies whenever possible;
- document every step, so another expert can repeat it and get the same result;
- guarantee integrity, proving that the data analysed is identical to the data acquired;
- separate facts from interpretation, distinguishing what the data shows from what is inferred from it.
The phases of a forensic engagement
Every job, from the simplest to the most complex, follows a logical sequence.
1. Identification
You establish which sources may hold relevant information: a laptop, a smartphone, an email account, a social media profile, a company server. This phase is often underestimated. Focus only on the computer and forget the cloud backup, and you may lose exactly the data that matters.
2. Acquisition
The data is copied with tools and procedures that do not modify it. For a drive, a bit-for-bit copy is made; for a phone, dedicated extraction methods are used; for a web page, a documented capture is performed. Every acquisition comes with an integrity fingerprint and a written record.
3. Preservation
Copies and any physical exhibits are stored so you can prove who handled them, when and why. This is the so-called chain of custody.
4. Analysis
You look for useful information: files, messages, browsing histories, system logs, metadata. Analysis is driven by precise questions, such as "when was this document created?" or "did this account log in from an unusual location?".
5. Reporting
The results are set out in a document that non-technical readers can understand, with attachments that allow verification. An effective report explains what was done, with which tools, what was found and what limits apply to the conclusions.
The main fields
Digital forensics is not a single block. It is divided into specialisations, each with its own techniques and problems.
| Field | What is analysed | Typical example |
|---|---|---|
| Computer forensics | Drives, file systems, operating system | Reconstructing use of a company PC |
| Mobile forensics | Smartphones and tablets | Recovering chats and locations |
| Network forensics | Network traffic and logs | Finding where an intrusion came from |
| Cloud forensics | Online services and accounts | Acquiring documents from remote storage |
| Memory forensics | RAM contents | Spotting a running malicious program |
| Web/OSINT | Public pages and sources | Documenting content published online |
Concrete examples
A company suspects that a departing employee took a customer list. Analysis of their computer may show a USB stick being connected, certain files being opened shortly before, and attachments being sent to a personal address. None of these elements is conclusive on its own, but together they form a coherent picture.
Someone receives abusive messages from a social media profile. Before the profile is deleted, a documented capture of the pages is needed, with date, address and context, along with the data that allows its authenticity to be checked.
A small professional practice is hit by an attack that encrypts its files. Besides restoring the systems, it is useful to understand how the attacker got in, so the gap can be closed and the incident does not happen again.
What digital forensics cannot do
It is fair to know the limits too. Not all deleted data can be recovered: on modern solid-state drives, deletion can make content unrecoverable within a short time. It is not always possible to link an action to a specific person: a shared computer or a password known to several people complicates attribution. And no analysis, however thorough, replaces the judgement of whoever has to decide: the expert provides facts, not verdicts.
When to call an expert
The best moment is before anyone touches the devices. Many problems come from improvised attempts: switching on the phone "to have a look", forwarding emails to yourself, taking screenshots with no context. In my forensic work, the first task is often limiting the damage done by these well-meant initiatives. If you think some data may be needed in the future, the simplest rule is to stop, change nothing, and write down what happened and when.
In short
- Digital forensics turns digital traces into reliable, verifiable evidence.
- Method matters more than tools: do not alter, document, guarantee integrity.
- The phases are identification, acquisition, preservation, analysis and reporting.
- There are different fields, from computers to smartphones, from networks to the cloud.
- Before touching a device, stop and ask for advice.