Digital forensics

Digital forensics is the systematic collection, examination, analysis and reporting of digital evidence to answer questions about events involving computing systems. It supports computer security incident investigation and troubleshooting as well as investigations associated with legal proceedings. Preserving the data and documenting how it was handled make later conclusions assessable.^[ref]

Collection and interpretation are different tasks. A cryptographic hash function can help check whether an acquired file has changed, but a matching digest does not establish who created the file or whether its contents are true. Chain of custody records handling history; it does not replace the analysis of what the evidence establishes.^[ref]

An original clock example illustrates the distinction. System A records an event at10:02 and system B records another at10:01. If A's clock is known to run two minutes fast while B's is correct, their reference times are10:00 and10:01. In symbols,where $\Delta$ is the stipulated clock offset. The apparent order reverses after correction. These invented times demonstrate why comparing log entries requires a clock model; they do not identify the actor responsible for either event.

A useful report therefore separates observed data, transformations such as clock correction, assumptions and conclusions. Missing records or uncertain offsets can leave several explanations consistent with the same digital evidence.

In digital forensics, a chain of custody is the documented history of who possessed or handled an item of digital evidence, when transfers occurred and what actions were taken. It connects an analyzed item with its recorded collection and subsequent handling. The record concerns provenance and accountability, while data integrity concerns whether the relevant data changed.^[ref]

For an original example, an evidence drive is recorded as collected by A at09:00, transferred to B at10:00 and delivered to C at12:00. If B's receipt and transfer record are missing, matching serial numbers at the endpoints do not explain what happened during the intervening interval. That is a gap in documentation, not by itself proof of alteration.

A cryptographic hash function supplies complementary evidence about a particular byte sequence. A matching digest can support continuity of the data under the hash function's security assumptions, but does not identify everyone who had access to it. A complete custody log likewise cannot establish the truth of every statement stored on a device.

A useful record therefore distinguishes the physical item, any acquired copies and the actions applied to each. Conclusions should state what that record supports; documentation alone does not determine every question about an incident.

Digital evidence is information represented in digital form that is used to support or test a claim about an event. A file, system log or recorded computer network activity can supply such information. An artifact becomes evidence through its relation to a question and the explanation of how it was obtained and interpreted; being stored on a computer does not make its contents true.^[ref]

Digital forensics separates collection from analysis. Chain of custody documents handling, and cryptographic hash functions help check continuity of acquired data. Those checks support the reliability of a particular artifact; they do not by themselves establish its author or the cause of the recorded event.^[ref]

An original mathematical distinction is useful. For a fixed deterministic hash function $h$, if byte sequences $x$ and $y$ satisfythen $x\ne y$. Identical inputs must produce identical outputs. The converse fails: $h(x)=h(y)$ does not logically prove $x=y$, since a fixed-length digest can have collisions. A well-chosen cryptographic hash function makes finding such collisions computationally difficult under its stated security assumptions.

Even exact byte equality is narrower than factual truth. Two identical copies of a log preserve the same recorded assertion, including any inaccurate clock value or fabricated entry already present. Interpretation must connect the artifact to independent context and identify uncertainty.