Digital forensics investigates what happened after a security incident. Investigators collect evidence from disks, memory, network logs, and mobile devices. They preserve it carefully so it holds up in court. The work is part technical, part procedural. A single mishandled step can render evidence inadmissible. Chain of custody, write blockers, and hash verification are standard practice.

The investigation answers questions. How did the attacker get in? What did they access? How long were they inside? Did they exfiltrate data? The answers shape the response and the legal strategy. Forensics also supports incident response. Understanding the attack helps contain it and prevent recurrence. The tools range from commercial suites like EnCase and FTK to open-source options like Autopsy and Volatility. Memory forensics is especially valuable because malware often lives only in RAM and leaves no trace on disk. Mobile forensics is its own specialty, with encrypted devices and cloud backups adding complexity. The field is always behind. New devices, new operating systems, and new encryption schemes create new challenges. Investigators adapt.

Forensics evidence sources

• Disk images — files, deleted data, and artifacts
• Memory dumps — running processes and malware in RAM
• Network logs — traffic patterns and connections
• Mobile devices — messages, apps, and location data

Forensics is not just about catching criminals. It is about understanding what happened so it does not happen again.