Fundaments of Digital Forensics

In this Lecture we are going to see about Introduction to Digital Forensics. Digital forensics has been in the popular mainstream for some time, and has matured into an information-technology capability that is very common among modern information security programs. The goal of digital forensics is to support the elements of troubleshooting, monitoring, recovery, and the protection of sensitive data.

In this Lecture we going see about Types of Digital Data. The forensic analyst usually recovers evidence material using a number of methods (and tools), often beginning with the recovery of deleted information. The type of data analyzed varies but will generally include email, chat logs, images, internet history and documents.

In this Lecture we are going to see about Digital Evidences. Digital evidence is information stored or transmitted in binary form that may be relied on in court. It can be found on a computer hard drive, a mobile phone, among other places. Digital evidence is commonly associated with electronic crime, or e-crime, such as child pornography or credit card fraud.

In this Lecture we are going to see about Evidence-based imaging. It consists of identifying the relevant imaging literature for a specific clinical question, understanding the strengths and limitations of the existing evidence, and then incorporating that evidence into clinical care.

In this Lecture we are going to see about Evidence Examination. All forensic examinations commonly include determining the date and time of the evidence system. Dates and times play one of the most critical parts of a forensic analysis as it is the basis of a timeline analysis.

In this Lecture we are going to see about First Responder, Investigator and Expert Witness. A first responder plays an important role in the computer forensics process because he or she is the first person who arrives at the crime scene for initial investigation. The investigation process starts after collecting all the evidence from the crime scene. A forensic expert witness is a type of expert witness who would provide expert forensic testimony within a trial. A commonly known form of forensic expert witness is a scientist who performed an examination of a human skeleton so as to provide important evidence for a criminal trial.

In this section, we will be discussing the critical steps that need to be followed to prevent loss of data before bringing to the forensic experts. Time is highly important in preserving digital evidence. Evidence preservation is the process of seizing suspect property without altering or changing the contents of data that resides on devices and removable media. It is the first step in digital evidence recovery.