Guide

Digital Forensics Guide

How to collect, examine and report digital evidence so it survives scrutiny. Seventeen short chapters, each one readable on its own, each one starting with the quick version.

It is for learners, practising examiners, and anyone who has to judge whether an examination was done properly. It covers workstations and laptops, servers and virtual machines, cloud services, phones, removable media and the network, and it goes deepest on Windows, Linux and macOS with full-disk encryption, because that is where the decisions you cannot undo get made.

It works for any investigation: misconduct, fraud, data theft, malware, a regulatory enquiry or a criminal matter. Where a case type changes the approach, the guide says so at the point it matters.

The two rules above all the others

  1. Stay inside your authority. A warrant, a written instruction from legal counsel, or a policy the user agreed to. Nothing beyond it.
  2. Do not change the evidence unless you have no choice. When you have no choice, make the smallest change you understand, and record exactly what you did and why.

Start here

No need to read it cover to cover. Pick the situation you are in.

All chapters

Six parts, in the order an examination runs: preserve, acquire, verify, examine, recover, correlate, validate, report. Sections are numbered 1 to 26 across the chapters, and every cross-reference is a link.

Part 1: Groundwork

  1. 1. Foundations 8 min, section 1
    What digital forensics is for, the four activities, the language of findings and the lifecycle every examination follows.

Part 2: On site

  1. 2. The scene 11 min, sections 2 to 4
    Securing the area, the power-state decision, documenting before touching, and cutting a live system off the network.
  2. 3. Identifying and prioritising evidence 6 min, sections 5 and 6
    Which devices and services can answer the questions, and the order to collect them in.
  3. 4. Volatile evidence 6 min, section 7
    Capturing memory and live system state: what, with which tools, the footprint and the paperwork.
  4. 5. Storage acquisition and integrity 9 min, sections 8 and 9
    Imaging through write blockers, coping with failing media, hashing and verification.
  5. 6. Custody and contingencies 6 min, sections 10 and 11
    Chain of custody, and what to do on site when devices are encrypted, damaged or will not image.

Part 3: Encrypted workstations

  1. 7. Encryption 8 min, section 12
    Spotting encryption, recovering keys from memory and legitimate sources, password recovery against copies, and why a rejected key proves nothing.
  2. 8. Windows 9 min, section 13
    BitLocker, the live procedure for an unlocked machine, the actions that lose access for good, and the powered-off route.
  3. 9. Linux 8 min, section 14
    LUKS, dm-crypt, LVM and loop devices on a live system, nested encryption, and notes on ext4, XFS, Btrfs and Linux artefacts.
  4. 10. macOS 10 min, section 15
    FileVault and APFS on a live Mac, the limits on T2 and Apple silicon, snapshots, clones and macOS artefacts.

Part 4: Wider sources and hidden data

  1. 11. Beyond the workstation 8 min, section 16
    Servers, virtual machines, cloud, mobile, removable media and network evidence: what changes and what does not.
  2. 12. Hidden data 9 min, section 17
    One method for any operating system: signatures, entropy, residual data, hidden storage, metadata, carving and steganography.
  3. 13. Reconstruction and recovery 13 min, sections 18 and 19
    Rebuilding a damaged filesystem from what survives, and recovering fragmented files by structure when the metadata is gone.

Part 5: Making it stand up

  1. 14. Validation 6 min, section 20
    Showing that reconstructed and recovered artefacts are what you say they are.
  2. 15. Analysis and correlation 9 min, sections 21 and 22
    Memory forensics, timelines, triage across several devices, and correlating Windows, Linux and macOS evidence.
  3. 16. Confidence, reporting and defensibility 8 min, sections 23 and 24
    The confidence scale, what a report must let another examiner understand, and the record that makes every finding reproducible.

Part 6: Toolkit

  1. 17. Practice 10 min, sections 25 and 26
    Best practice, the mistakes that wreck evidence, and printable checklists for the scene and the lab.

Revision history

Fifth edition. Rewritten for skimming. Every chapter opens with the quick version, a reading time and a progress bar; every section starts with an "In short" line and ends with a checklist; warnings, tips and worked examples are called out so they cannot be missed. This page now groups the chapters into six parts and offers routes in by situation. No section numbers or links changed.

Earlier editions

Fourth edition. Reorganised from one page into seventeen chapters, with section numbering kept continuous and every cross-reference made a link. Added section 16, Beyond the workstation, covering servers, virtual machines, cloud services, mobile devices, removable media and network evidence, so that the guide describes the discipline rather than one class of device. The introduction was rewritten to match.

Third edition. Added platform-specific live and powered-off procedures for Windows with BitLocker, Linux with LUKS and dm-crypt including nested encryption, and macOS with FileVault and APFS; a unified cross-platform data-hiding methodology, which absorbed the earlier steganography material; multi-device triage and cross-device correlation; the contents of a forensic report; the tool-reported label; and structural validation requirements.

Second edition. Replaced two pieces of earlier advice. Switching a device to aeroplane mode was previously suggested as an isolation step; it is a software interaction that changes system state, so section 4 prefers physical isolation and treats aeroplane mode as a last resort. Data carving was previously described as a general technique; Reconstruction and recovery and Validation require metadata-based reconstruction before carving and set out how carved results must be validated, because a carved file that opens is not thereby shown to be correct.