Digital Forensics
In the world of cybersecurity, digital forensics is the detective work of the digital age, where skilled investigators uncover the digital breadcrumbs left behind by cybercriminals, shedding light on their criminal activities.
NIST SP 800-86, Guide to Integrating Forensic Techniques into Incidents, breaks down the forensic process consists of four phases:
Figure 21.3: Forensics process
The phases illustrated in Figure 21.3 can be described as follows:
- Collection: Law enforcement collects evidence from a crime scene, ensuring that the integrity of the evidence is maintained and that it is bagged and tagged ready for a forensic examination.
- Examination: Prior to examination, the data will be hashed, and then an investigation will be carried out with the relevant forensic tool. When the examination has concluded, the data is once again hashed to ensure that neither the examiner nor the tools have tampered with it.
- Analysis...
