Understanding the Digital Forensics

UNIT 1 : INTRODUCTION

PRESENTED BY:
SARISHMA

BOOK REFERRED:
GUIDE TO COMPUTER FORENSICS AND
INVESTIGATIONS PROCESSING DIGITAL EVIDENCE
BY BILL NELSON, AMELIA PHILLIPS,
CHRISTOPHER STEUART
Describing digital forensics
Old and New definitions
Data recovery vs forensics
Investigation Triad
The definition of digital forensics has also evolved
over the years from simply involving securing and
analyzing digital information stored on a computer
for use as evidence in civil, criminal, or
administrative cases. 
“The application of computer science and
investigative procedures for a legal purpose involving
the analysis of digital evidence (information of
probative value that is stored or transmitted in
binary form) after proper search authority, chain of
custody, validation with mathematics (hash
function), use of validated tools, repeatability,
reporting and possible expert  presentation”

Source: Defining Digital Forensics,” Forensic Magazine, 2007

Digital forensics can be defined as a branch of
forensic science dedicated to recovery and
investigation of digital or electronic data. These data
can be from any digital asset or data storing entity,
which includes a computer system, mobile device,
cloud service, and so on.
Technically, all these digital assets have a different
design to store data and this makes the very base for
dividing digital forensics into several categories. Its
various subbranches include computer forensics,
network forensics, forensic data analysis, and mobile
device forensics.
Can Digital Forensics be trusted? 
Why is Digital Forensics important?
 “Guide to Integrating Forensic Techniques into Incident
Response” - NIST

Digital forensics is defined as “the application of

science to the identification, collection, examination,
and analysis of data while preserving the integrity of
the information and maintaining a strict chain of
custody for the data.”

 (
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
, 2006),
 Digital forensics VS data recovery

Data recovery involves retrieving information that

was deleted by mistake or lost during a power surge or
server crash, for example.
In data recovery, typically you know what you’re looking
for.
Digital forensics is the task of recovering data that users
have hidden or deleted, with the goal of ensuring that
the recovered data is valid so that it can be used as
evidence.
Examiners often approach a digital device not knowing
whether it contains evidence.
Investigation Triad
Vulnerability/threat assessment and risk
management

Network intrusion detection and incident response

Digital investigations