ExamWizardzExamWizardz
Start free
Security

What is digital forensics?

Digital forensics is the collection, preservation and analysis of digital evidence using documented methods so its findings hold up to legal scrutiny.

What is digital forensics?

Digital forensics is the discipline of identifying, collecting, preserving, analyzing and reporting on digital evidence in a way that can withstand challenge from management, regulators, insurers or a court. In incident response, it answers the questions that decide everything else: how the attacker got in, when, which systems and accounts they touched, and what data they viewed or took. What separates forensics from ordinary troubleshooting is method. Every step is documented and repeatable, and the evidence is provably unchanged from the moment it was collected.

The forensic process

  1. Identification: work out what evidence exists and where: endpoints, servers, cloud consoles, network devices, logs, backups and mobile devices.
  2. Preservation: stop evidence from being altered or deleted. Legal counsel may issue a legal hold that suspends routine deletion.
  3. Acquisition: collect evidence in order of volatility, memory before disk, using trusted tools, and hash every item at collection.
  4. Analysis: examine verified copies, never the originals, to build a timeline and answer the investigation's questions.
  5. Reporting: document the findings, the methods, tools and versions used, and the evidence each conclusion rests on.

Published guidance for this work includes RFC 3227 for evidence collection, NIST SP 800-86 for integrating forensic techniques into incident response, and ISO/IEC 27037 for identifying, collecting, acquiring and preserving digital evidence.

Acquisition methods

  • Memory dump: a copy of RAM from a running system, holding processes, network connections, injected code and sometimes encryption keys that vanish at shutdown.
  • Bit-level image: a sector-by-sector copy of a drive, including unallocated and slack space where deleted data can survive, usually taken through a write blocker.
  • Snapshot: a point-in-time copy of a virtual machine or cloud volume taken by the hypervisor or cloud platform.
  • Log and cloud exports: copies of logs and audit trails, hashed when exported.

Example: proving an image is unchanged

An examiner connects a suspect drive through a hardware write blocker, hashes it, images it, and hashes the image:

sha256sum /dev/sdc

dd if=/dev/sdc of=/evidence/case117/disk.dd bs=4M status=progress

sha256sum /evidence/case117/disk.dd

When both SHA-256 values match, the image is an exact copy of the drive. The original is sealed and stored, analysis happens on a working copy, and a chain of custody form records every hand-off. Some tools record MD5 or SHA-1 alongside for compatibility, but both are broken for collision resistance, so SHA-256 is the value to rely on.

Digital forensics vs. incident response vs. e-discovery

  • Incident response aims to contain the threat and restore operations. Forensics supports it by establishing the facts defensibly, and the two run side by side.
  • E-discovery is the legal process of finding and producing electronically stored information for a lawsuit. It focuses on relevant records, while forensics digs into system artifacts, deleted data and attacker activity.
  • Chain of custody is one part of forensics: the record of who handled each item and when.

Digital forensics on the CompTIA Security+ exam

Digital forensics sits in objective 4.7 on SY0-801, within the investigation phase of incident response, and in objective 4.8, which covers the data sources and system images an investigation relies on. Expect scenarios about what to collect first (memory, following the order of volatility), how to prove evidence wasn't altered (hashing and write blockers), how to show who handled it (chain of custody) and how to stop deletion when litigation is expected (legal hold). A common trap is shutting down or reimaging a compromised system before capturing memory. Another is choosing hashing when the question asks how to document who held the evidence.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

chain of custody

Chain of custody is the documented, unbroken record of who collected, handled, transferred and stored a piece of evidence, when, and why.

e-discovery

E-discovery (electronic discovery) is the legal process of finding, preserving, collecting and producing electronically stored information for litigation.

file hashing

File hashing is a cryptographic technique that generates a unique fixed-length string of characters (hash value or digest) from a file's contents, enabling verification of data integrity and authenticity without encryption. Any change to the file, no matter how small, produces a completely different hash, making it impossible to modify a file undetected.

incident response

Incident response is the set of steps for handling a security breach, malware or prohibited content: identify, report, preserve evidence and document.

legal hold

A legal hold is an instruction from legal counsel to preserve all data relevant to expected litigation or an investigation, suspending routine deletion.

order of volatility

The order of volatility is the sequence for collecting digital evidence from most to least volatile, so short-lived data such as RAM is captured first.

← Back to the full CompTIA glossary