Digital forensics goes beyond collecting evidence off a computer and is much more complicated than it seems on the surface. Digital forensics involves processes and objectives that must be followed in order to properly preserve and present evidence.
Digital Forensics helps the forensic team to analyze, inspect, identifies, and preserve the digital evidence residing on various types of electronic devices.
The following processes and objectives are used in digital forensic evidence collection and investigations.
Objectives of computer forensics
- It helps to recover, analyze, and preserve computer and related materials in such a manner that it helps the investigation agency to present them as evidence in a court of law.
- It helps to postulate the motive behind the crime and identity of the main culprit.
- Designing procedures at a suspected crime scene which helps you to ensure that the digital evidence obtained is not corrupted.
- Data acquisition and duplication: Recovering deleted files and deleted partitions from digital media to extract the evidence and validate them.
- Helps you to identify the evidence quickly, and also allows you to estimate the potential impact of the malicious activity on the victim.
- Producing a computer forensic report which offers a complete report on the investigation process.
- Preserving the evidence by following the chain of custody.
Process of Digital Forensics
- Identification
- Preservation
- Analysis
- Documentation
- Presentation
Identification
It is the first step in the forensic process. The identification process mainly includes things like what evidence is present, where it is stored, and lastly, how it is stored (in which format). Electronic storage media can be personal computers, Mobile phones, PDAs, etc.
Preservation
In this phase, data is isolated, secured, and preserved. It includes preventing people from using the digital device so that digital evidence is not tampered with.
Analysis
In this step, investigation agents reconstruct fragments of data and draw conclusions based on evidence found. However, it might take numerous iterations of examination to support a specific crime theory.
Documentation
In this process, a record of all the visible data must be created. It helps in recreating the crime scene and reviewing it. It Involves proper documentation of the crime scene along with photographing, sketching, and crime-scene mapping.
Presentation
In this last step, the process of summarizing and explanation of conclusions is done.
