Digital forensics comprises the techniques which deal with the restoration and investigation of digital evidence. It is part of forensic science, which involves the process of identifying, collecting, preserving, analyzing, and presenting digital data or evidence. It aims to reconstruct the sequence of events, which had taken place at the crime scene. Digital data can be recovered from devices, which store digital data.
There are two main types of investigations in digital forensics:
- Public Investigations – These are investigations that are conducted for crimes against people. The government usually handles all investigations related to the public sector.
- Private Investigations – These investigations are carried out for crime that is related to businesses or organizations. Violation of policies in the private sector falls under this category.
How Forensics is Used in an Investigation:
The investigation process is a step by step procedure that is carried out
meticulously to ensure that no evidence is destroyed during the process.
Identification – This involves the identification of all the potential digital sources which are capable of storing digital information and media. Identification is the foremost step in any investigation.
Collection: All the digital devices, which are potential sources of evidence is removed from the crime scene and properly collected.
The data collection can be further divided into three main types:
1. Volatile Data Collection – This is the collection of all the running data like user-logged in details, date, time, and other RAM data.
2. Live System Imaging – This includes the imaging action performed on the running data.
3. Forensic Imaging – A duplicated copy of the original device is created to perform imaging actions. The exact copy of the device is created to perform manipulations.
Preservation – Preservation is an important step as it is necessary to preserve the place where the crime occurred. It is also important to preserve all the Electronically Stored Information (ESI) which could be obtained from the crime scene.
Analysis – The analysis process involves the in-depth examination of all the digital evidence. Proper imaging is performed to ensure that the original evidence does not lose its authenticity. The examination and study of the criminal scenario help the investigator to come to a conclusion.