= Digital forensics
\b[Digital forensics] is the systematic collection, examination, analysis and reporting of <digital evidence> to answer questions about events involving computing systems. It supports <computer security> incident investigation and troubleshooting as well as investigations associated with legal proceedings. Preserving the data and documenting how it was handled make later conclusions assessable.<Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others>[Section2.1, p.2-2, and section3, four-phase forensic process]{ref}
Collection and interpretation are different tasks. A <cryptographic hash function> can help check whether an acquired file has changed, but a matching digest does not establish who created the file or whether its contents are true. <Chain of custody> records handling history; it does not replace the analysis of what the evidence establishes.<Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others>[Section3.1, data acquisition and integrity; section3.3, analysis]{ref}
An original clock example illustrates the distinction. System A records an event at10:02 and system B records another at10:01. If A's clock is known to run two minutes fast while B's is correct, their reference times are10:00 and10:01. In symbols,
$$
t_{\mathrm{reference}}=t_{\mathrm{recorded}}-\Delta,
$$
where $\Delta$ is the stipulated clock offset. The apparent order reverses after correction. These invented times demonstrate why comparing log entries requires a clock model; they do not identify the actor responsible for either event.
A useful report therefore separates observed data, transformations such as clock correction, assumptions and conclusions. Missing records or uncertain offsets can leave several explanations consistent with the same <digital evidence>.
Back to article page
