Glossary term
Digital Forensics
Subject: Legal, Tax and Reporting, Dispute and Investigation Management
Also known as: Computer forensics, Cyber forensics, Forensic IT analysis
Digital forensics is the careful examination of computers, phones, servers and cloud accounts to recover data and establish what happened, with handling strict enough for the results to be used as evidence.
Explanation
Specialists first make an exact copy of the device or account so the original stays untouched, then work on the copy. They look for deleted files, browsing and messaging history, login records, file timestamps and signs of tampering or data theft. Findings are written up in a report that explains the method, so another expert could repeat it. Because data is easy to change by accident, the work depends on strict handling and a logged chain of custody. Typical uses include employee misconduct, fraud, intellectual property theft, data breaches and responses to regulators. It differs from routine incident response, which aims to stop and fix a problem quickly, while forensics aims to establish what happened and prove it. Without it, a claim that someone copied files stays an allegation; with it, the claim arrives with timestamps and a method others can test.
Example
A company suspects that a departing engineer took design files. A forensic examiner images his laptop and finds that 4,000 files were copied to an external drive the night before his resignation. The report lists the file names, times and device serial number, and legal counsel uses it to seek the return of the files.
Not to be confused with
- Electronic discovery
- E-discovery collects and reviews electronic documents for a legal case. Forensics examines devices and data to reconstruct events and prove what occurred.