> ## Documentation Index
> Fetch the complete documentation index at: https://stem-docs.intellectualpoint.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Digital forensics
> Discover how investigators collect, preserve, and analyze digital evidence after a security incident.
## The science of digital evidence
When a cyberattack happens, stopping the attacker is only half the job. You also need to figure out **what happened**, **how it happened**, **who did it**, and **what was affected**. That is the role of digital forensics.
**Digital forensics** is the scientific examination of digital devices, storage media, and network activity to collect, preserve, and analyze evidence. The findings are used to understand incidents, support legal proceedings, and prevent future attacks.
Digital forensics follows the same principles as physical crime scene investigation. Just like a detective preserves fingerprints and photographs a crime scene before touching anything, a forensic analyst creates exact copies of digital evidence and maintains a documented chain of custody.
Think of a forensic investigator as a digital detective. They don't guess what happened - they prove it with evidence.
***
## When forensics is needed
Not every security alert requires a full forensic investigation. But certain situations demand one:
| Situation | Why forensics is needed |
| --------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| **Data breach** | Determine what data was accessed, by whom, and how much was stolen |
| **Ransomware attack** | Identify the initial infection vector, scope of encryption, and whether data was exfiltrated before encryption |
| **Employee misconduct** | Investigate whether an employee stole data, installed unauthorized software, or violated policy |
| **Legal dispute** | Produce digital evidence for litigation (contracts, communications, file access records) |
| **Law enforcement investigation** | Support criminal investigations - cybercrime, fraud, harassment, or intellectual property theft |
| **Regulatory compliance** | Demonstrate to regulators (PCI DSS, HIPAA, GDPR) that you investigated properly and took appropriate action |
| **Insurance claims** | Provide evidence to cyber insurance providers about what happened and the extent of damages |
Even if you don't plan to go to court, forensic rigor matters. Sloppy evidence handling can destroy your ability to understand the incident and prevent the next one.
***
## The forensics process
Digital forensics follows a structured process designed to ensure evidence is collected properly, handled carefully, and analyzed thoroughly. Every step matters - cutting corners at any stage can invalidate the entire investigation.
Immediately preserve all relevant data. No deletion, modification, or routine cleanup is allowed on any system that might contain evidence.
A legal hold is a formal notice that tells everyone in the organization: **stop destroying data**. This includes:
* Disabling automated log rotation on relevant systems
* Suspending email deletion policies
* Preserving backup tapes that would normally be recycled
* Notifying employees to retain documents related to the incident
Failure to implement a legal hold can result in **spoliation of evidence** - the legal term for destroying evidence, whether intentional or accidental. Courts and regulators take this very seriously.
From the moment you collect evidence, you must document every person who handles it, when they handled it, and what they did with it.
The chain of custody is a **documented trail** that proves evidence has not been tampered with. It records:
| Field | Example |
| ----------------------- | ----------------------------------------------------------------- |
| **Item description** | Dell Latitude 5540 laptop, Serial #DL5540-29471 |
| **Date/time collected** | 2026-06-25, 10:32 AM ET |
| **Collected by** | Analyst Maria Santos |
| **Storage location** | Evidence locker, Room 204, Shelf B |
| **Access log** | Every time someone accesses the evidence, they sign and timestamp |
If the chain of custody is broken - meaning there is a gap where evidence was unaccounted for - the evidence may be **inadmissible in court**. A defense attorney will argue it could have been tampered with during that gap.
Create exact, bit-for-bit copies (called **forensic images**) of all relevant drives and systems. You never work on the original evidence - you work on copies.
Key principles:
* **Use write blockers:** Hardware or software devices that prevent any data from being written to the original drive. This ensures you don't accidentally modify evidence while copying it.
* **Create verified images:** After imaging, generate a cryptographic hash (MD5 or SHA-256) of both the original and the copy. If the hashes match, your copy is a perfect replica.
* **Image everything relevant:** Hard drives, USB devices, mobile phones, cloud storage, RAM (volatile memory that is lost when the system powers off).
**Never** examine the original evidence directly. Always work from a forensic image. If you make a mistake on a copy, you can create another copy. If you corrupt the original, that evidence is gone forever.
This is where the detective work happens. Forensic analysts examine the evidence using specialized tools to reconstruct what happened.
Analysts look for:
* **Deleted files:** Files that were "deleted" often still exist on the drive until their space is overwritten. Forensic tools can recover them.
* **Registry entries:** On Windows systems, the registry records software installations, USB device connections, user activity, and system configuration changes.
* **Log entries:** System, application, and security logs provide a timeline of events.
* **Timestamps:** File creation, modification, and access times reveal when things happened and in what order.
* **Malware artifacts:** Suspicious executables, scripts, configuration files, or network connections left behind by the attacker.
* **Browser history and cached data:** Websites visited, files downloaded, search queries.
* **Email headers:** Reveal the true origin of phishing emails, not just the display name.
The goal is to build a **complete timeline** of the incident from initial compromise to discovery.
Document your findings in a clear, detailed report that can be understood by **non-technical audiences** - judges, executives, HR departments, and regulators.
A forensic report typically includes:
* Executive summary (what happened, in plain language)
* Scope of the investigation (what was examined)
* Methodology (tools and techniques used)
* Findings (with supporting evidence - screenshots, log excerpts, timeline)
* Conclusions (what the evidence proves)
* Recommendations (how to prevent recurrence)
Writing for non-technical readers is a critical forensic skill. A brilliant analysis is worthless if the judge or CEO cannot understand it. Use plain language, visual timelines, and clear explanations.
**E-Discovery** (electronic discovery) is the process of identifying, collecting, and producing electronically stored information (ESI) for legal proceedings.
When an organization faces a lawsuit, regulatory inquiry, or internal investigation, lawyers need access to relevant digital documents - emails, chat messages, documents, database records, and more.
E-Discovery is often handled by specialized legal technology teams, but security professionals are frequently involved because they understand where data lives and how to collect it without altering it.
***
## Types of logs to analyze
Logs are the bread and butter of digital forensics. Every system, application, and device generates logs that record what happened and when. Knowing which logs to examine - and what to look for - is a core forensic skill.
| Log type | What it records | Example finding |
| -------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| **Firewall logs** | Network traffic allowed or denied through the firewall | Blocked connection attempt from a known malicious IP address in Eastern Europe |
| **Application logs** | Software events, errors, and user actions within applications | 47 failed login attempts to the admin panel between 2:00 and 3:00 AM |
| **Endpoint logs** | Activity on individual devices (workstations, laptops, servers) | USB storage device connected to the accounting workstation at 11:58 PM |
| **OS logs** | Operating system events - logins, service starts/stops, account changes | New administrator account "svc\_backup" created at 4:12 AM by an unknown process |
| **IPS/IDS logs** | Threats detected or blocked by intrusion prevention/detection systems | SQL injection attempt against the customer portal - blocked by IPS rule 4471 |
| **Network logs** | Traffic patterns, connections, bandwidth usage | 4.7 GB transferred to an external IP address in 23 minutes at 3:00 AM |
| **Metadata** | Data about data - file properties, email headers, document attributes | Confidential report last modified at 6:15 PM - two hours after the employee's termination took effect |
No single log type tells the whole story. The power of forensics comes from **correlating** multiple log sources to build a complete picture of what happened.
***
## Log correlation
Individual logs are puzzle pieces. **Log correlation** is the process of assembling those pieces into a coherent picture by combining data from multiple sources and identifying patterns that no single log would reveal.
### How correlation works
Imagine you are investigating a suspected data breach at Donuts & Dragons. Looking at each log source in isolation, you see:
```
2026-06-25 03:14:22 ALLOW TCP 10.0.1.50 → 185.234.72.19:443
2026-06-25 03:14:23 ALLOW TCP 10.0.1.50 → 185.234.72.19:443
2026-06-25 03:27:41 ALLOW TCP 10.0.1.50 → 185.234.72.19:443
```
Outbound traffic from internal server 10.0.1.50 to an external IP address at 3 AM. Suspicious, but could be a scheduled update.
```
2026-06-25 03:12:07 PROCESS_START cmd.exe → powershell.exe
2026-06-25 03:12:09 PROCESS_START powershell.exe → svchost_update.exe
2026-06-25 03:13:58 FILE_ACCESS C:\POS\transactions\*.csv (READ)
```
A PowerShell process spawned an executable with a suspicious name. Moments later, POS transaction files were accessed.
```
2026-06-25 03:13:42 QUERY SELECT * FROM transactions
WHERE date > '2026-01-01'
2026-06-25 03:14:01 EXPORT transactions_dump.csv (4.2 GB)
```
Someone queried the entire transaction database and exported the results to a CSV file.
### The correlated picture
Alone, each log raises questions. Together, they tell a clear story:
1. **03:12 AM** - An attacker launches PowerShell and runs a disguised executable on server 10.0.1.50
2. **03:13 AM** - The executable queries the POS database and exports all transaction data since January
3. **03:14 AM** - The exported data (4.2 GB) is transmitted to an external IP address (185.234.72.19)
4. **03:27 AM** - A second connection confirms the transfer completed
**Conclusion:** This is a data exfiltration event. Customer payment data was stolen.
Without log correlation, you might dismiss the firewall log as routine traffic and never connect it to the database export. Correlation is what transforms raw data into actionable intelligence.
***
## Real-world example: ransomware at Donuts & Dragons
Let's walk through how a forensic investigation would unfold after a ransomware attack on our favorite donut shop.
**Monday, 7:00 AM.** The opening manager arrives and finds every screen displaying a ransom note: a red dragon demanding 2 Bitcoin. The POS system is locked. The office computer is locked. The inventory management system is locked.
The manager calls the owner, who calls the IT support company.
**Monday, 8:30 AM.** The IT team arrives and confirms:
* All Windows systems are encrypted with ransomware
* The file server, POS system, and office workstation are affected
* The Wi-Fi router and network switches appear unaffected (they run Linux)
* The most recent backup is from Friday at 11 PM
The team implements a legal hold and begins documenting everything.
**Monday, 10:00 AM.** Forensic analysts:
* Create forensic images of all affected hard drives using write blockers
* Capture firewall and router logs before they rotate
* Image the email server to preserve the original phishing email
* Photograph all ransom note screens
* Collect RAM dumps from systems that are still powered on (ransomware decryption keys are sometimes found in memory)
Every piece of evidence is logged in the chain of custody.
**Monday-Tuesday.** Analysts examine the forensic images and discover:
| Finding | Source | Significance |
| ------------------------------------------ | ----------------- | ---------------------------------------------------------------------- |
| Phishing email received Friday 2:15 PM | Email server logs | Initial attack vector identified |
| Employee clicked link at 2:17 PM | Browser history | Confirms user interaction |
| Malware dropper downloaded at 2:17 PM | Endpoint logs | Identifies the malicious payload |
| Lateral movement to file server at 2:45 PM | Network logs | Attacker spread beyond initial machine |
| Ransomware deployed at 11:30 PM Friday | OS logs | Attacker waited for off-hours to encrypt |
| No data exfiltration detected | Firewall logs | No outbound transfers to external IPs - data was encrypted, not stolen |
**Timeline reconstruction:** The attacker phished an employee on Friday afternoon, moved laterally to the file server within 30 minutes, then waited until late Friday night to deploy the ransomware - maximizing damage and minimizing the chance of detection.
The forensic report concludes:
* **Root cause:** Employee clicked a phishing link. No email filtering or security awareness training was in place.
* **Scope:** Three systems encrypted. No evidence of data exfiltration.
* **Recovery path:** Restore from Friday 11 PM backup (data loss: approximately 30 minutes of Friday transactions).
* **Recommendations:** Implement email filtering, deploy security awareness training, enable multi-factor authentication, segment the network to limit lateral movement.
***
## Forensics tools of the trade
Professional forensic investigators use specialized tools. Here are some you might encounter:
Industry-standard forensic platform used by law enforcement and corporations worldwide. Creates forensic images, analyzes file systems, and generates court-ready reports.
Powerful forensic analysis tool known for its fast processing and ability to handle large datasets. Popular for email analysis and file carving.
Free, open-source forensic platform. Great for learning forensics. Performs file recovery, timeline analysis, keyword searching, and hash filtering.
Network traffic analyzer that captures and inspects packets in real time. Essential for understanding what data was transmitted over the network.
***
## Key takeaways
Always work from forensic images. The original evidence must remain pristine for legal proceedings.
Every gap in custody is an opportunity for a defense attorney to challenge your evidence. Document everything.
No single log tells the whole story. Combine firewall, endpoint, application, and network logs to reconstruct events.
Forensic reports must be understandable by non-technical readers - judges, executives, and regulators.