In short
Digital forensics is collecting, preserving and analyzing digital evidence, such as disk images, memory and logs, in a way that will stand up in legal proceedings.
Key takeaways
- Analysis is done on verified copies, using hash values, not on the originals.
- A documented chain of custody must be kept.
- Volatile evidence, such as memory, should be captured before systems are shut down.
Where it's tested
ISC: Incident Response & Monitoring — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
During an investigation of suspected fraud, investigators copy a laptop's hard drive and record who handled the copy, when and why. This record is the: