Digital Forensics.

What is digital forensics?

NIST SP 800-86 defines digital forensics as the application of science to the identification, collection, examination and analysis of data, while preserving the integrity of the information and keeping a strict chain of custody for the data. A chain of custody is a record of who held the evidence, what they did with it and when.

Another NIST glossary entry describes it as the process used to acquire, preserve, analyze and report on evidence using scientific methods that are reliable, accurate and repeatable, so that the results may be used in judicial proceedings.

How does digital forensics work?

NIST SP 800-86 says the forensic process has four basic phases.

• Collection: identify, label, record and acquire data from the possible sources, using procedures that preserve its integrity. NIST notes that collection is typically done in a timely manner, because dynamic data such as current network connections can be lost, as can data from battery-powered devices.
• Examination: process the collected data with a mix of automated and manual methods to find and extract the data of interest, while protecting its integrity.
• Analysis: study the results of the examination, using legally justifiable methods, to answer the questions that led to the investigation.
• Reporting: present the results of the analysis. NIST says this can include describing the actions taken, deciding what other actions are needed, and recommending improvements to policies, procedures, tools and other parts of the process.

Why does chain of custody matter?

NIST SP 800-86 says that when evidence may be needed in legal or internal disciplinary proceedings, a clearly defined chain of custody should be followed to avoid allegations of mishandling or tampering. It describes this as keeping a log of every person who had physical custody of the evidence, documenting what they did and at what time, and storing the evidence in a secure location when it is not in use.

What is digital forensics used for?

NIST SP 800-86 presents the guide as help for organizations investigating computer security incidents and troubleshooting some IT operational problems. It covers data from sources such as files, operating systems, network traffic and applications. The guide takes an IT view of forensics, not a law enforcement view. It also advises readers to consult management and legal counsel about laws and regulations before applying its recommended practices.

As a simple illustration, an organization that finds a suspicious system might collect data from it, examine and analyze that data, and then write up what happened and what to improve. This is a generic example, not a description of any real case.

How does digital forensics relate to nearby terms?

Digital forensics is often part of handling a security incident. The title of NIST SP 800-86 is “Guide to Integrating Forensic Techniques into Incident Response”. Related terms include incident response plan, data breach and indicator of compromise.

Is digital forensics the same as incident response?

No. Incident response is the wider effort to handle a security incident. Digital forensics is the evidence-focused work of collecting, examining, analyzing and reporting on data. NIST SP 800-86 treats forensic techniques as something to integrate into incident response.

Is digital forensics only used for legal cases?

No. NIST SP 800-86 says forensic guidance can support investigating security incidents and troubleshooting some operational problems, and it separately notes that evidence may need to support legal or internal disciplinary proceedings when that is decided in advance.