Digital Forensics · 4 min
Digital Forensics Fundamentals
Reconstructing what happened from what was left behind
This lesson explains the concept, then checks your understanding in a short interactive exercise.
What digital forensics is
Digital forensics is the disciplined reconstruction of events from digital evidence. The output is not a feeling about what happened — it is a description of events, each tied to an artifact, with the uncertainty stated plainly.
- Collect evidence without changing it more than necessary
- Interpret artifacts in context, not in isolation
- Separate what is observed from what is inferred
Where evidence lives
Different sources answer different questions. Investigations usually need several of them.
- Endpoint and filesystem: files, paths, installed software, metadata
- Memory: running processes, open connections, loaded modules
- Logs: authentication, application, endpoint agent, audit trails
- Network, cloud and mobile: flow records, service audit logs, device backups
Loading the interactive lesson…