Knowra Digital forensics Digital forensics Digital forensics is the collection, preservation, examination, and presentation of evidence from computers, networks, and other electronic devices. It uses documented methods to protect evidence integrity and support reliable conclusions.
Forensic imaging : The bit-for-bit acquisition of a storage device or other digital medium for examination. A verified image lets investigators examine data without altering the original evidence.
Computer forensics : The acquisition and analysis of evidence stored on computers and their storage media. It is the branch most directly concerned with desktop and laptop evidence.
Metadata : Data that describes other data, including properties such as creation time, format, or authorship. Metadata can supply context about files, though it may be altered or misleading.
Cybersecurity : The practice of protecting systems, networks, and data from digital attacks and unauthorized access. Security aims to prevent or limit harm; forensics reconstructs events and preserves evidence.
Write blocker : A hardware or software tool that prevents changes to a storage device during access. It helps prevent examination tools from modifying the source medium.
Mobile device forensics : The recovery and analysis of evidence from mobile phones, tablets, and related devices. Mobile devices combine communications, location records, apps, and device-specific data.
Deleted file recovery : The recovery of file contents or records that remain after deletion from a storage device. Deletion often removes references before it overwrites the underlying data.
Penetration testing : An authorized assessment that simulates attacks to identify exploitable security weaknesses. Penetration testing seeks vulnerabilities under agreed conditions, not evidence about a past incident.
Cryptographic hash function : A function that maps data of any size to a fixed-length value used to detect changes. Matching hashes can show that an acquired image remained unchanged.
Network forensics : The capture and analysis of network traffic and related records to investigate activity. Network traces can reveal communications and actions not recorded on a seized device.
Show all 22