Digital Forensics

Evidence collection, analysis techniques, forensic tools, and legal considerations.

Overview

Digital forensics investigates cyber incidents for evidence.

Forensic Process

Evidence Types

Forensic Tools

Memory Analysis

# Volatility analysis
import volatility.conf as conf
import volatility.commands as commands

# List processes
volatility -f memory.dmp --profile=Win7SP1x64 pslist

# Extract network connections
volatility -f memory.dmp --profile=Win7SP1x64 netscan

# Dump process
volatility -f memory.dmp --profile=Win7SP1x64 procdump -p 1234

Disk Forensics

# Create forensic image
dd if=/dev/sda of=/evidence/disk.img bs=4M

# Calculate hash
md5sum /evidence/disk.img
sha256sum /evidence/disk.img

# Mount image
mount -o loop,ro /evidence/disk.img /mnt/evidence

# Search for files
find /mnt/evidence -name "*.doc" -o -name "*.pdf"

Chain of Custody

Legal Considerations

1. Authorization — Proper warrants
2. Chain of Custody — Evidence tracking
3. Documentation — Detailed logs
4. Expert Testimony — Court presentation
5. Privacy Laws — Data protection

Practice

Analyze a forensic image using Autopsy and document findings.