What is Digital Forensics?
Digital forensic investigations have a variety of applications. The most common is to support or refute a hypothesis before criminal or civil (as part of the electronic discovery process) courts. Forensics may also feature in the private sector, such as during internal corporate investigations or intrusion investigation (a specialist probe into the nature and extent of an unauthorized network intrusion).
The technical aspect of an investigation is divided into several sub-branches, relating to the type of digital devices involved; computer forensics, network forensics, database forensics, and mobile device forensics. The typical forensic processes include evidence collection (seizure), analysis of digital media, forensic imaging (acquisition), and production of reports with collected findings and evidence.
As well as identifying direct evidence of a crime, digital forensics can be used to attribute evidence to specific suspects, confirm alibis or statements, determine intent, identify sources (for example, in copyright cases), or authenticate documents. Investigations are much broader in scope than other areas of forensic analysis (where the common aim is to provide answers to a series of more straightforward questions) often involving complex timelines or hypotheses.