Catalog
concept#Security#Analytics#Data

Digital Forensics

Digital forensics covers methods and processes for identifying, collecting and analysing digital evidence. The aim is to preserve evidence integrity to support incident response, forensic investigations and legal proceedings.

Digital forensics is the discipline of identifying, collecting, preserving, and analysing digital evidence to support incident response, legal proceedings, and threat attribution.
Established
High

Classification

  • High
  • Technical
  • Organizational
  • Advanced

Technical context

SIEM and log management systemsEndpoint Detection and Response (EDR)Case management and incident response platforms

Principles & goals

Collect once, analyze many: preserve evidence once and analyse copies repeatedly.Maintain chain of custody: every action must be documented and traceable.Minimise intervention: avoid altering original data and log any changes.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Contamination of evidence due to improper handling.
  • Breaks in chain-of-custody may render evidence inadmissible.
  • Misinterpretation of artifacts without contextual knowledge.
  • Use standardized, documented procedures for collection and analysis
  • Ensure integrity via hashing and redundant storage
  • Regular training and tabletop exercises for forensic readiness

I/O & resources

  • Endpoint images and memory dumps
  • Network captures and proxy logs
  • Authentication and application logs
  • Forensic findings and reports
  • Secure copies and artifact repository
  • Legally admissible chain-of-custody documentation

Description

Digital forensics is the discipline of identifying, collecting, preserving, and analysing digital evidence to support incident response, legal proceedings, and threat attribution. It defines procedures, tools and governance to ensure evidence integrity and legal admissibility. Forensic readiness reduces investigation time and preserves chain-of-custody.

✔

  • Enables root-cause analysis and attribution of security incidents.
  • Supports legal actions with court-admissible evidence.
  • Improves incident response via preparedness and documented processes.

✖

  • Resource intensive: time and specialised tools required.
  • Legal constraints vary across jurisdictions.
  • Incomplete telemetry or encrypted data can limit analysis.

  • Time to evidence preservation

    Time between incident detection and secure preservation of relevant evidence.

  • Number of preserved artifacts per incident

    Count of secured files, images and log segments used for analysis.

  • Time to forensic report completion

    Duration until completion of a legally defensible investigation report.

Ransomware incident analysis

Examine encryption chain, recover artifacts and determine initial access vectors.

Mobile device examination

Secure extraction of user data and app logs to reconstruct user actions.

Log-based threat attribution

Correlate network, proxy and authentication logs to identify an attacker.

1

Establish forensic policies, chain-of-custody rules and responsibilities

2

Instrument logging, central collection and long-term retention

3

Deploy tooling, train analysts and run regular readiness exercises

⚠️ Technical debt & bottlenecks

  • Outdated tools lacking support for modern filesystems
  • Insufficient central log storage and retention
  • No documented, repeatable forensic workflows
Limited log retentionResource and tooling constraintsSkill shortage in forensics team
  • Altering evidence to speed recovery without documentation
  • Unauthorized forensic actions by unapproved personnel
  • Incomplete log preservation prior to policy-driven deletion
  • Unclear responsibilities cause delays in evidence preservation
  • Missing timestamp synchronization complicates correlation
  • Excessive alteration of originals compromises evidence
Forensic imaging and validationFilesystem and artifact analysisKnowledge of legal requirements and e-discovery
Legal admissibility of evidenceAvailability and quality of logging/telemetryRetention and data protection requirements
  • • Legal frameworks and privacy constraints
  • • Encrypted or inaccessible storage
  • • Dependence on third-party logs in cloud environments