Guide
Digital Forensics Guide
How to collect, examine and report digital evidence so that it survives scrutiny. Written for learners and practising examiners, and for anyone who has to understand what a competent examination looks like. It covers the complete lifecycle for every common source of evidence: workstations and laptops, servers and virtual machines, cloud services, phones, removable media and the network. It goes deepest on Windows, Linux and macOS systems with full-disk encryption, because that is where the decisions that cannot be undone are made.
It applies to any investigation, whether misconduct, fraud, data theft, malware, a regulatory enquiry or a criminal matter. Where a type of case or a type of evidence calls for a different approach, that is said at the point it matters.
Two rules sit above everything else. First, only act within the authority you have been given, whether that is a warrant, a written instruction from legal counsel or a policy the user agreed to. Second, never do anything that changes the evidence unless you have no choice, and when you have no choice, make the smallest change you understand, and record exactly what you did and why.
How to read it
The seventeen chapters follow the order of an examination: preserve, acquire, verify, examine, recover, correlate, validate, report. Read Foundations first; it defines the labels and the confidence scale the rest depends on. After that, the chapters stand alone and cross-reference one another by section number, so an examiner facing a live Linux machine can start at Linux and follow the links. Sections are numbered 1 to 26 across the chapters. Practice ends with checklists to print.
Chapters
- 1. Foundations
What digital forensics is for, the four activities, the language of findings and the lifecycle every examination follows. - 2. The scene
First actions on arrival: securing the area, the power-state decision, documenting everything before it is touched, and isolating live systems. - 3. Identifying and prioritising evidence
Which devices and services can answer the investigative questions, and in what order they must be collected. - 4. Volatile evidence
Acquiring memory and live system state: what to capture, which tools, the acquisition footprint and the documentation required. - 5. Storage acquisition and integrity
Physical imaging through write blockers, fault-tolerant acquisition of failing media, hashing, verification and what must be preserved. - 6. Custody and contingencies
Chain of custody for physical and digital exhibits, and what to do on site when devices are encrypted, damaged or will not image. - 7. Encryption
Identifying encryption, recovering keys from memory and legitimate sources, password recovery against copies, and why a rejected key is not proof. - 8. Windows
BitLocker components, the live procedure for an unlocked Windows machine, the actions that remove access permanently, and the powered-off route. - 9. Linux
LUKS, dm-crypt, LVM and loop devices on a live system, nested encryption, and examination notes for ext4, XFS, Btrfs and Linux artefacts. - 10. macOS
FileVault and APFS on a live Mac, the limits of physical acquisition on T2 and Apple silicon, snapshots, clones and macOS artefacts. - 11. Beyond the workstation
Servers, virtual machines, cloud services, mobile devices, removable media and network evidence: what changes and what does not. - 12. Hidden data
An operating-system independent method for finding concealed data: signatures, entropy, residual data, hidden storage, metadata, carving and steganography. - 13. Reconstruction and recovery
Reconstructing a damaged filesystem from surviving metadata, and recovering deliberately fragmented files by structure when metadata is gone. - 14. Validation
How reconstructed and recovered artefacts are shown to be what the examiner says: documentation, structural checks, corroboration and independent reproduction. - 15. Analysis and correlation
Memory forensics, timeline analysis, triage across several devices, and correlating evidence between Windows, Linux and macOS systems. - 16. Confidence, reporting and defensibility
The confidence scale, what a report must let another examiner understand, and the record that makes every finding reproducible. - 17. Practice
Best practices, the mistakes that compromise evidence, and printable checklists for the scene and the laboratory.
Revision history
Fourth edition. Reorganised from one page into seventeen chapters, with section numbering kept continuous and every cross-reference made a link. Adds section 16, Beyond the workstation, covering servers, virtual machines, cloud services, mobile devices, removable media and network evidence, so that the guide describes the discipline rather than one class of device. The introduction is rewritten to match.
Third edition. Added platform-specific live and powered-off procedures for Windows with BitLocker, Linux with LUKS and dm-crypt including nested encryption, and macOS with FileVault and APFS; a unified cross-platform data-hiding methodology, which absorbed the earlier steganography material; multi-device triage and cross-device correlation; the contents of a forensic report; the tool-reported label; and structural validation requirements.
Second edition. Replaced two pieces of earlier advice. Switching a device to aeroplane mode was previously suggested as an isolation step; it is a software interaction that changes system state, so section 4 prefers physical isolation and treats aeroplane mode as a last resort. Data carving was previously described as a general technique; Reconstruction and recovery and Validation require metadata-based reconstruction before carving and set out how carved results must be validated, because a carved file that opens is not thereby shown to be correct.