Process and analysis
What is Digital forensics?
Collecting and examining digital evidence from computers, phones and networks in a way that preserves it and can stand up to scrutiny.
Digital forensics is the careful collection and analysis of evidence from computers, phones, servers, cloud services and networks. It reconstructs what happened, when and by whom, while preserving the evidence so that the findings can be checked and, if necessary, used in court.
In security work it is often combined with incident response, hence the common abbreviation DFIR. Typical sources include disk images, memory captures, event logs, browser history and file system artefacts.