DIGITAL FORENSICS
Preserve evidence.
Document every step.
Digital forensics involves identifying, preserving, examining, and reporting digital evidence using methods that protect its integrity.
Core concepts
- Authorization: confirm lawful authority and scope before handling devices or data.
- Preservation: avoid unnecessary changes to original evidence.
- Integrity: use cryptographic hashes such as SHA-256 to check whether files have changed.
- Documentation: record dates, tools, actions, and observations clearly.
- Reporting: separate observed facts from assumptions and explain limitations.
Practice with sample files, forensic training images, and systems you own or are authorized to examine. This page is educational and is not legal advice.