Digital forensics is the systematic collection, examination, analysis and reporting of digital evidence to answer questions about events involving computing systems. It supports computer security incident investigation and troubleshooting as well as investigations associated with legal proceedings. Preserving the data and documenting how it was handled make later conclusions assessable.[ref]
Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others. Section2.1, p.2-2, and section3, four-phase forensic process
Collection and interpretation are different tasks. A cryptographic hash function can help check whether an acquired file has changed, but a matching digest does not establish who created the file or whether its contents are true. Chain of custody records handling history; it does not replace the analysis of what the evidence establishes.[ref]
Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others. Section3.1, data acquisition and integrity; section3.3, analysis
An original clock example illustrates the distinction. System A records an event at10:02 and system B records another at10:01. If A's clock is known to run two minutes fast while B's is correct, their reference times are10:00 and10:01. In symbols,where is the stipulated clock offset. The apparent order reverses after correction. These invented times demonstrate why comparing log entries requires a clock model; they do not identify the actor responsible for either event.
A useful report therefore separates observed data, transformations such as clock correction, assumptions and conclusions. Missing records or uncertain offsets can leave several explanations consistent with the same digital evidence.
New to topics? Read the docs here!