Digital evidence fundamentals · Lesson 3 of 3
The forensic process
5 min read
Digital forensics follows a process. Different standards and textbooks draw it with different boxes, but they agree on the essentials: find the evidence, preserve it, copy it in a verifiable way, examine it, interpret what it means and report the results so that others can check them. This lesson walks through those phases, the standards that describe them, and the rules that apply from the first step to the last.
One process, several descriptions
You will meet several models. They describe the same work at different levels of detail.
| Reference | What it describes |
|---|---|
| ISO/IEC 27037 | Identification, collection, acquisition and preservation of digital evidence |
| ISO/IEC 27041 | Assuring that the methods and tools used are suitable and adequate (validation) |
| ISO/IEC 27042 | Analysis and interpretation of digital evidence |
| ISO/IEC 27043 | The overall investigation process that ties all of these together |
| NIST SP 800-86 | Four phases: collection, examination, analysis and reporting |
This course uses six phases that combine these references. Knowing how they map onto each other helps you read any procedure, whichever model it follows.
Before the first phase: preparation
Good investigations start before anything happens. Preparation, which ISO/IEC 27043 treats as readiness, includes trained people, validated tools, clean storage media, forms for notes and chain of custody, and agreed procedures. For an organization, it also means keeping the logs and records that an investigation will need, for long enough, and knowing who can authorize an examination. A team that has to improvise these on the day loses time and makes avoidable mistakes.
Questions drive the process
Each examination answers specific questions, and those questions shape every phase. "Did this account copy the client list to removable media between 1 and 15 March?" tells the examiner which devices to identify, which data to acquire, which artifacts to examine and what the report must answer. A vague request, such as "check the laptop", should be turned into precise questions with the person who asked for the examination before work begins. Clear questions also keep the work within scope and make it easier to say when the examination is finished.
The six phases
| Phase | Goal | Typical output |
|---|---|---|
| Identification | Recognize where relevant data may be: devices, accounts, logs, people who know about them | A list of potential sources and priorities |
| Collection and acquisition | Gather the items, or make verified copies of the data, within the authorized scope | Seized items, forensic images, hash values |
| Preservation | Keep originals and copies unchanged and accounted for | Sealed and labeled items, chain of custody records, secure storage |
| Examination | Extract and make the data readable: parse file systems, recover deleted items, filter and search | Extracted files, artifacts and timelines |
| Analysis | Interpret the results to answer the questions of the case, testing alternative explanations | Findings, each with its basis and degree of confidence |
| Reporting | Communicate method, findings and limitations clearly to people who are not specialists | A written report that others can review |
Collection or acquisition?
ISO/IEC 27037 separates two ideas that are easy to confuse. Collection is gathering the physical items that may hold digital evidence, such as taking a laptop into custody. Acquisition is creating a copy of the data, such as a forensic image of the laptop's drive. Sometimes only acquisition is possible: a company server that must keep running, or data held by a cloud provider, is copied rather than taken away. Module 3 covers seizure and Module 4 covers acquisition.
Examination or analysis?
Examination makes data available: it turns a disk image into a list of files, recovers deleted records and extracts artifacts such as browser history. Analysis asks what the data means for the case. Finding that a file was copied to a USB drive is examination; concluding, after checking other explanations, that a particular account copied it at a particular time is analysis. ISO/IEC 27042 covers this interpretive step. Good practice is to consider competing hypotheses and to state how confident the examiner is in each conclusion.
Rules that run through every phase
- Work on verified copies. Examine forensic images, not originals, and confirm with hash values that copies match the source.
- Document as you go. Record actions, times, tools and versions, and the reasons for decisions, at the moment they happen (Module 5).
- Keep the chain of custody. Every transfer of an item or copy is recorded, so that its history has no gaps.
- Use validated methods and tools. Know what a tool does, its limits and how its results were checked (ISO/IEC 27041).
- Stay within scope. Examine only what the authorization covers and the questions require (Module 2).
- Separate facts from interpretation. Say what the data shows, then what you infer from it and how sure you are.
A short walk-through
An employer suspects that a departing engineer copied design files to a personal USB drive. Following the process:
- Identification: the engineer's company laptop, the file server holding the design files, the server's access logs and any USB drive the engineer returns.
- Collection and acquisition: the laptop is taken into custody and imaged; the relevant server logs are exported; hash values are recorded for every image and export.
- Preservation: originals are sealed and stored; each image is verified and logged in the chain of custody.
- Examination: the image is processed to list USB devices that were connected, recently opened files and file system activity.
- Analysis: the examiner builds a timeline, compares it with the server logs, and tests other explanations, such as an automatic backup or another user of the laptop.
- Reporting: the report states what was examined, how, what was found, what could not be determined, and how confident the examiner is in each finding.
Notice that the order is not strictly linear. Analysis may reveal a new source, such as a cloud account, that sends the examiner back to identification. The process is a discipline for each step, not a one-way conveyor belt.
Exam focus: Know the six phases and their order, how they map to ISO/IEC 27037 (identification, collection, acquisition, preservation), ISO/IEC 27042 (analysis and interpretation), ISO/IEC 27041 (validation), ISO/IEC 27043 (overall process) and NIST SP 800-86 (collection, examination, analysis, reporting). Be able to tell collection from acquisition and examination from analysis, and list the rules that apply to every phase.