Digital Forensics Flashcards
The application of investigation and analysis techniques to gather and preserve evidence from digital sources.
Digital forensics
The formal documentation that proves evidence has not been altered and was handled properly.
Chain of custody
A hash value used to verify the integrity of forensic images and data.
MD5 or SHA-1 hash
Making an exact, bit-for-bit copy of a digital device for forensic analysis.
Imaging
The first response step in forensics to ensure systems are not tampered with.
Evidence preservation
The safest type of imaging that doesn’t modify the original data.
Write-blocked imaging
A forensic action used to reconstruct attacker activity from logs or memory.
Timeline analysis
A forensic process that recovers deleted or fragmented data.
File carving
A temporary, volatile data source that must be captured before shutting down a system.
RAM (volatile memory)
The stage in digital forensics where collected data is reviewed for evidence.
Examination
The process of documenting forensic findings and presenting them clearly to stakeholders.
Reporting
A live forensic technique used to collect data from a system while it’s running.
Volatile data acquisition
Tool used to analyze disk images and file systems in forensic investigations.
Autopsy or FTK Imager
The final phase of the forensic process where lessons learned are shared.
Post-incident review
The type of forensics used to investigate suspicious behavior within logs and event files.
Log forensics
An incident type requiring forensics when intellectual property is stolen.
Data breach investigation
The standard order of volatility when collecting evidence.
CPU cache → RAM → disk → backups
A location in digital forensics where original evidence is securely stored.
Evidence locker
Forensic technique used to analyze unallocated disk space.
Slack space analysis
Temporary storage space that may hold valuable artifacts like passwords or recent files.
Pagefile or swap file
The process of examining running processes, open connections, and system artifacts on live systems.
Live forensics
A type of tool that helps identify who accessed what file and when.
File access audit tool
The forensic process of validating that the evidence matches what was originally acquired.
Integrity check
The device used to prevent modification during forensic acquisition.
Hardware write blocker
The practice of isolating systems to prevent tampering during forensic review.
Evidence containment
A tool used to extract browser history, cookies, and cache during investigations.
Internet Evidence Finder (IEF)
Artifacts like shellbags, prefetch files, and jump lists are found in what system?
Windows OS
A standard forensic format used to store disk images.
E01 format
The forensic method used to understand what was done on a device without directly examining it.
Artifact analysis
A structured process for identifying, collecting, analyzing, and preserving digital evidence.
Forensic investigation lifecycle
