What is Digital forensics?

The techniques and procedures for collecting data that serve as evidence from computers and network devices, analyzing it while keeping it free from tampering and establishing what happened, for the investigation of incidents and crimes. The basics are collecting the most volatile data first (such as memory contents and the state of network connections), copying the original media with writes blocked, confirming identity with hash values and recording every handover of the evidence (chain of custody).

Japanese name: デジタルフォレンジック

Digital forensics appears in 1 practice question across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about Digital forensics

Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?

AMemory contents and the state of current network connections → disk contents → backups and archives stored externally
BBackups and archives stored externally → disk contents → memory contents and the state of current network connections
CDisk contents → after powering off, memory contents and the state of current network connections → backups stored externally

Show answer and explanation

Answer: A. Memory contents and the state of current network connections → disk contents → backups and archives stored externally

RFC 3227 (2002), a guideline for collecting evidence in digital forensics, recommends collecting the most easily lost data first. CPU registers and caches, memory contents, running processes and the state of network connections are lost over time or when the power is turned off, so they are collected first. Memory may contain malware that leaves nothing on disk, or information in decrypted form. Disk contents are copied and examined afterwards, and backups and archives stored externally change little, so they can come last.

Digital forensics in the explanations

RFC 3227 (2002), a guideline for collecting evidence in digital forensics, recommends collecting the most easily lost data first.
Evidence for an investigation is to be collected from a ser…

Questions that mention Digital forensics (1)

Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?

Books on Cyber Attacks and Defense in Practice Ad

Search Amazon for semiconductor Cyber Attacks and Defense in Practice

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary