Proper procedures for collecting and preserving digital evidence.
Detailed records, timestamps, signatures
Unique identifiers, custody logs, transfer records
Hash verification, digital signatures, tamper detection
Evidence lockers, access controls, environmental controls
Memory acquisition, running processes, network connections
CPU registers, cache, RAM, swap files, hard drives
Incident response, evidence preservation, system stabilization
Packet capture, traffic analysis, network artifacts
Methods and tools for analyzing digital evidence.
NTFS, FAT, ext4, HFS+, APFS
Recovery of deleted files, file signature analysis
File timestamps, event correlation, activity reconstruction
File attributes, creation dates, modification times
Physical memory dumps, hibernation files, crash dumps
Running processes, process injection, malware detection
Network connections, sockets, communication channels
Passwords, encryption keys, browser artifacts
Specialized techniques for mobile devices and cloud environments.
iPhone analysis, iTunes backups, iCloud data
ADB access, app data, system logs
Social media apps, messaging, location data
Device encryption, app-level encryption, key extraction
AWS, Azure, Google Cloud, SaaS applications
Cloud logs, API calls, authentication records
Data location, legal requirements, cross-border issues
Legal holds, data retention, evidence preservation
Essential tools and legal considerations for digital forensics.