Digital forensics

The science of digital evidence

When a cyberattack happens, stopping the attacker is only half the job. You also need to figure out what happened, how it happened, who did it, and what was affected. That is the role of digital forensics. Digital forensics is the scientific examination of digital devices, storage media, and network activity to collect, preserve, and analyze evidence. The findings are used to understand incidents, support legal proceedings, and prevent future attacks.

Digital forensics follows the same principles as physical crime scene investigation. Just like a detective preserves fingerprints and photographs a crime scene before touching anything, a forensic analyst creates exact copies of digital evidence and maintains a documented chain of custody.

Think of a forensic investigator as a digital detective. They don’t guess what happened - they prove it with evidence.

When forensics is needed

Not every security alert requires a full forensic investigation. But certain situations demand one:

Situation	Why forensics is needed
Data breach	Determine what data was accessed, by whom, and how much was stolen
Ransomware attack	Identify the initial infection vector, scope of encryption, and whether data was exfiltrated before encryption
Employee misconduct	Investigate whether an employee stole data, installed unauthorized software, or violated policy
Legal dispute	Produce digital evidence for litigation (contracts, communications, file access records)
Law enforcement investigation	Support criminal investigations - cybercrime, fraud, harassment, or intellectual property theft
Regulatory compliance	Demonstrate to regulators (PCI DSS, HIPAA, GDPR) that you investigated properly and took appropriate action
Insurance claims	Provide evidence to cyber insurance providers about what happened and the extent of damages

Even if you don’t plan to go to court, forensic rigor matters. Sloppy evidence handling can destroy your ability to understand the incident and prevent the next one.

The forensics process

Digital forensics follows a structured process designed to ensure evidence is collected properly, handled carefully, and analyzed thoroughly. Every step matters - cutting corners at any stage can invalidate the entire investigation.

Legal hold

Immediately preserve all relevant data. No deletion, modification, or routine cleanup is allowed on any system that might contain evidence.A legal hold is a formal notice that tells everyone in the organization: stop destroying data. This includes:

Disabling automated log rotation on relevant systems
Suspending email deletion policies
Preserving backup tapes that would normally be recycled
Notifying employees to retain documents related to the incident

Failure to implement a legal hold can result in spoliation of evidence - the legal term for destroying evidence, whether intentional or accidental. Courts and regulators take this very seriously.

Chain of custody

From the moment you collect evidence, you must document every person who handles it, when they handled it, and what they did with it.The chain of custody is a documented trail that proves evidence has not been tampered with. It records:

Field	Example
Item description	Dell Latitude 5540 laptop, Serial #DL5540-29471
Date/time collected	2026-06-25, 10:32 AM ET
Collected by	Analyst Maria Santos
Storage location	Evidence locker, Room 204, Shelf B
Access log	Every time someone accesses the evidence, they sign and timestamp

If the chain of custody is broken - meaning there is a gap where evidence was unaccounted for - the evidence may be inadmissible in court. A defense attorney will argue it could have been tampered with during that gap.

Acquisition

Create exact, bit-for-bit copies (called forensic images) of all relevant drives and systems. You never work on the original evidence - you work on copies.Key principles:

Use write blockers: Hardware or software devices that prevent any data from being written to the original drive. This ensures you don’t accidentally modify evidence while copying it.
Create verified images: After imaging, generate a cryptographic hash (MD5 or SHA-256) of both the original and the copy. If the hashes match, your copy is a perfect replica.
Image everything relevant: Hard drives, USB devices, mobile phones, cloud storage, RAM (volatile memory that is lost when the system powers off).

Never examine the original evidence directly. Always work from a forensic image. If you make a mistake on a copy, you can create another copy. If you corrupt the original, that evidence is gone forever.

Analysis

This is where the detective work happens. Forensic analysts examine the evidence using specialized tools to reconstruct what happened.Analysts look for:

Deleted files: Files that were “deleted” often still exist on the drive until their space is overwritten. Forensic tools can recover them.
Registry entries: On Windows systems, the registry records software installations, USB device connections, user activity, and system configuration changes.
Log entries: System, application, and security logs provide a timeline of events.
Timestamps: File creation, modification, and access times reveal when things happened and in what order.
Malware artifacts: Suspicious executables, scripts, configuration files, or network connections left behind by the attacker.
Browser history and cached data: Websites visited, files downloaded, search queries.
Email headers: Reveal the true origin of phishing emails, not just the display name.

The goal is to build a complete timeline of the incident from initial compromise to discovery.

Reporting

Document your findings in a clear, detailed report that can be understood by non-technical audiences - judges, executives, HR departments, and regulators.A forensic report typically includes:

Executive summary (what happened, in plain language)
Scope of the investigation (what was examined)
Methodology (tools and techniques used)
Findings (with supporting evidence - screenshots, log excerpts, timeline)
Conclusions (what the evidence proves)
Recommendations (how to prevent recurrence)

Writing for non-technical readers is a critical forensic skill. A brilliant analysis is worthless if the judge or CEO cannot understand it. Use plain language, visual timelines, and clear explanations.

E-Discovery

E-Discovery (electronic discovery) is the process of identifying, collecting, and producing electronically stored information (ESI) for legal proceedings.When an organization faces a lawsuit, regulatory inquiry, or internal investigation, lawyers need access to relevant digital documents - emails, chat messages, documents, database records, and more.E-Discovery is often handled by specialized legal technology teams, but security professionals are frequently involved because they understand where data lives and how to collect it without altering it.

Types of logs to analyze

Logs are the bread and butter of digital forensics. Every system, application, and device generates logs that record what happened and when. Knowing which logs to examine - and what to look for - is a core forensic skill.

Log type	What it records	Example finding
Firewall logs	Network traffic allowed or denied through the firewall	Blocked connection attempt from a known malicious IP address in Eastern Europe
Application logs	Software events, errors, and user actions within applications	47 failed login attempts to the admin panel between 2:00 and 3:00 AM
Endpoint logs	Activity on individual devices (workstations, laptops, servers)	USB storage device connected to the accounting workstation at 11:58 PM
OS logs	Operating system events - logins, service starts/stops, account changes	New administrator account “svc_backup” created at 4:12 AM by an unknown process
IPS/IDS logs	Threats detected or blocked by intrusion prevention/detection systems	SQL injection attempt against the customer portal - blocked by IPS rule 4471
Network logs	Traffic patterns, connections, bandwidth usage	4.7 GB transferred to an external IP address in 23 minutes at 3:00 AM
Metadata	Data about data - file properties, email headers, document attributes	Confidential report last modified at 6:15 PM - two hours after the employee’s termination took effect

No single log type tells the whole story. The power of forensics comes from correlating multiple log sources to build a complete picture of what happened.

Log correlation

Individual logs are puzzle pieces. Log correlation is the process of assembling those pieces into a coherent picture by combining data from multiple sources and identifying patterns that no single log would reveal.

How correlation works

Imagine you are investigating a suspected data breach at Donuts & Dragons. Looking at each log source in isolation, you see:

Firewall log
Endpoint log
Application log

2026-06-25 03:14:22  ALLOW  TCP  10.0.1.50 → 185.234.72.19:443
2026-06-25 03:14:23  ALLOW  TCP  10.0.1.50 → 185.234.72.19:443
2026-06-25 03:27:41  ALLOW  TCP  10.0.1.50 → 185.234.72.19:443

Outbound traffic from internal server 10.0.1.50 to an external IP address at 3 AM. Suspicious, but could be a scheduled update.

2026-06-25 03:12:07  PROCESS_START  cmd.exe → powershell.exe
2026-06-25 03:12:09  PROCESS_START  powershell.exe → svchost_update.exe
2026-06-25 03:13:58  FILE_ACCESS    C:\POS\transactions\*.csv (READ)

A PowerShell process spawned an executable with a suspicious name. Moments later, POS transaction files were accessed.

2026-06-25 03:13:42  QUERY  SELECT * FROM transactions
                            WHERE date > '2026-01-01'
2026-06-25 03:14:01  EXPORT  transactions_dump.csv (4.2 GB)

Someone queried the entire transaction database and exported the results to a CSV file.

The correlated picture

Alone, each log raises questions. Together, they tell a clear story:

03:12 AM - An attacker launches PowerShell and runs a disguised executable on server 10.0.1.50
03:13 AM - The executable queries the POS database and exports all transaction data since January
03:14 AM - The exported data (4.2 GB) is transmitted to an external IP address (185.234.72.19)
03:27 AM - A second connection confirms the transfer completed

Conclusion: This is a data exfiltration event. Customer payment data was stolen.

Without log correlation, you might dismiss the firewall log as routine traffic and never connect it to the database export. Correlation is what transforms raw data into actionable intelligence.

Real-world example: ransomware at Donuts & Dragons

Let’s walk through how a forensic investigation would unfold after a ransomware attack on our favorite donut shop.

Discovery

Monday, 7:00 AM. The opening manager arrives and finds every screen displaying a ransom note: a red dragon demanding 2 Bitcoin. The POS system is locked. The office computer is locked. The inventory management system is locked.The manager calls the owner, who calls the IT support company.

Initial assessment

Monday, 8:30 AM. The IT team arrives and confirms:

All Windows systems are encrypted with ransomware
The file server, POS system, and office workstation are affected
The Wi-Fi router and network switches appear unaffected (they run Linux)
The most recent backup is from Friday at 11 PM

The team implements a legal hold and begins documenting everything.

Evidence collection

Monday, 10:00 AM. Forensic analysts:

Create forensic images of all affected hard drives using write blockers
Capture firewall and router logs before they rotate
Image the email server to preserve the original phishing email
Photograph all ransom note screens
Collect RAM dumps from systems that are still powered on (ransomware decryption keys are sometimes found in memory)

Every piece of evidence is logged in the chain of custody.

Analysis

Monday-Tuesday. Analysts examine the forensic images and discover:

Finding	Source	Significance
Phishing email received Friday 2:15 PM	Email server logs	Initial attack vector identified
Employee clicked link at 2:17 PM	Browser history	Confirms user interaction
Malware dropper downloaded at 2:17 PM	Endpoint logs	Identifies the malicious payload
Lateral movement to file server at 2:45 PM	Network logs	Attacker spread beyond initial machine
Ransomware deployed at 11:30 PM Friday	OS logs	Attacker waited for off-hours to encrypt
No data exfiltration detected	Firewall logs	No outbound transfers to external IPs - data was encrypted, not stolen

Timeline reconstruction: The attacker phished an employee on Friday afternoon, moved laterally to the file server within 30 minutes, then waited until late Friday night to deploy the ransomware - maximizing damage and minimizing the chance of detection.

Conclusions and report

The forensic report concludes:

Root cause: Employee clicked a phishing link. No email filtering or security awareness training was in place.
Scope: Three systems encrypted. No evidence of data exfiltration.
Recovery path: Restore from Friday 11 PM backup (data loss: approximately 30 minutes of Friday transactions).
Recommendations: Implement email filtering, deploy security awareness training, enable multi-factor authentication, segment the network to limit lateral movement.

Forensics tools of the trade

Professional forensic investigators use specialized tools. Here are some you might encounter:

EnCase

Industry-standard forensic platform used by law enforcement and corporations worldwide. Creates forensic images, analyzes file systems, and generates court-ready reports.

FTK (Forensic Toolkit)

Powerful forensic analysis tool known for its fast processing and ability to handle large datasets. Popular for email analysis and file carving.

Autopsy

Free, open-source forensic platform. Great for learning forensics. Performs file recovery, timeline analysis, keyword searching, and hash filtering.

Wireshark

Network traffic analyzer that captures and inspects packets in real time. Essential for understanding what data was transmitted over the network.

Key takeaways

Never touch the original

Always work from forensic images. The original evidence must remain pristine for legal proceedings.

Chain of custody is sacred

Every gap in custody is an opportunity for a defense attorney to challenge your evidence. Document everything.

Correlation reveals the story

No single log tells the whole story. Combine firewall, endpoint, application, and network logs to reconstruct events.

Write for your audience

Forensic reports must be understandable by non-technical readers - judges, executives, and regulators.

Welcome

Class Recordings

Day 1: Foundations of Cybersecurity

Day 2: Threats and Attacks

Day 3: Architecture and Wargame

Day 4: Incident Response

Day 5: USB Rubber Ducky

The science of digital evidence

When forensics is needed

The forensics process

Types of logs to analyze

Log correlation

How correlation works

The correlated picture

Real-world example: ransomware at Donuts & Dragons

Forensics tools of the trade

EnCase

FTK (Forensic Toolkit)

Autopsy

Wireshark

Key takeaways

Never touch the original

Chain of custody is sacred

Correlation reveals the story

Write for your audience

​The science of digital evidence

​When forensics is needed

​The forensics process

​Types of logs to analyze

​Log correlation

​How correlation works

​The correlated picture

​Real-world example: ransomware at Donuts & Dragons

​Forensics tools of the trade

EnCase

FTK (Forensic Toolkit)

Autopsy

Wireshark

​Key takeaways

Never touch the original

Chain of custody is sacred

Correlation reveals the story

Write for your audience

The science of digital evidence

When forensics is needed

The forensics process

Types of logs to analyze

Log correlation

How correlation works

The correlated picture

Real-world example: ransomware at Donuts & Dragons

Forensics tools of the trade

Key takeaways