Part 1: GroundworkChapter 1 of 17About 8 minutes
1. Foundations
Read this first. It sets out the purpose of the work, the legal footing, the four activities you keep apart, the labels every statement must carry, and the order the rest of the guide follows.
The quick version
- Findings must be reliable and reproducible. Each one traces back to a specific artefact another examiner could find again.
- Get authority in writing first and stay inside its scope. Searching without it can be a crime and can get the evidence excluded.
- Keep four activities apart: preservation, acquisition, analysis and documentation. Never analyse the original.
- Label every statement: observed fact, tool output, interpretation, hypothesis, recovered, reconstructed, or conclusion with a confidence.
- Follow the order: preserve, acquire, verify, examine, recover, correlate, validate, report.
- Record every significant action: tool, version, configuration, command, times, operator, errors.
Open this when: you are new to the guide, or you need to check how a statement in your notes or report should be labelled.
In this chapter
- Four activities, kept apart
- The language of findings
- The lifecycle
- Introduction to digital forensics (section 1)
Four activities, kept apart
In short: keeping these four apart stops you analysing the original, or acquiring before the scene is preserved.
- Preservation. Stopping evidence from being changed, lost or destroyed. Securing the scene, isolating devices from networks, deciding what to leave powered on.
- Acquisition. Making a complete, verified copy of the evidence: a memory capture, a physical image of a drive, an export from a server or cloud platform.
- Analysis. Examining verified copies for what happened: which files existed, what was done with them, and when. Analysis never happens on the original.
- Documentation. Recording every action, every person and every hand-over, from the moment you arrive to the moment the findings are presented. It runs through all three of the others.
Find your place
Every numbered section in this guide is labelled with the activity it belongs to, in the small heading above its title.
Before you move on
- You can name the four activities and what each one covers.
- You know analysis only ever happens on a verified copy.
- You know documentation runs alongside everything else.
The language of findings
In short: a report that blurs what was seen with what was inferred will not survive cross-examination, so label every statement.
From the first note to the final report, each statement is one of these:
| Label | What it means | Examples |
|---|
| Observed fact | Something you saw, measured or read directly and could show to another person. | A screen photograph, a hash value, a partition table entry, a timestamp in an intact metadata record. |
| Tool-reported information | What a tool says about the evidence. It is an observation about the tool's output, not about the evidence, until you have checked it against the underlying bytes or a second tool. | A parser's file listing, a carver's output, an imager's hash, a decoder's error position. |
| Examiner interpretation | What you understand a fact or tool report to mean, based on documented knowledge of how the system behaves. | "The device was first connected to this machine on that date." |
| Inference or investigative hypothesis | A proposed explanation you are testing, not a finding. | A theory that shapes what you look for next. |
| Recovered evidence | Data obtained from the evidence with no examiner construction. | A file read from an intact filesystem, a deleted file whose allocation record is intact, a record parsed from a log. |
| Reconstructed or derived artefact | Something you assembled or computed. Always reported as such, with the method and the inputs. | A file carved from unallocated space, fragments joined by hand, a timeline built from several sources, a decrypted volume. |
| Conclusion with a stated confidence | An answer to an investigative question, graded on the scale in section 23 (confirmed, strongly supported, probable, possible). | Never stronger than the weakest link in the chain of evidence that supports it. |
Treat tool output with suspicion
Tools mis-parse damaged structures, assume contiguity and silently tolerate errors. A report that repeats a tool's output as fact has not examined anything.
Separate fact from interpretation
Example
"The USB device key records a first connection on that date" is fact. "The device was first connected to this machine on that date" is interpretation, and depends on the clock being right and the key being intact.
Keep hypotheses in their place
Hypotheses belong in your notes and shape what you look for. They appear in a report only as hypotheses, with what supported and what contradicted them.
Stop and think
Never present a reconstructed artefact as equivalent to an untouched original. The two look identical on screen. They are not the same evidence.
Before you move on
- Every statement in your notes carries one of the seven labels.
- Tool output is checked against the bytes or a second tool before it is called fact.
- Hypotheses appear in a report only as hypotheses, with evidence for and against.
- Reconstructed artefacts are reported with method and inputs, never as originals.
The lifecycle
In short: the whole method is one ordered sequence, and the order is the point.
Preserve, acquire, verify, examine, recover, correlate, validate, report.
Why the order matters
- Preservation before acquisition, because an unpreserved scene cannot be acquired faithfully.
- Verification before examination, because an unverified copy proves nothing.
- Recovery and correlation before validation, because a reconstruction is a hypothesis until it is tested.
- Validation before reporting, because the report states confidence, and confidence is what validation produces.
Where each chapter fits
| Stage | Chapters |
|---|
| Preserve | The scene, Identifying and prioritising evidence |
| Acquire and verify | Volatile evidence, Storage acquisition and integrity, Custody and contingencies, Beyond the workstation |
| Examine and recover | Encryption, the Windows, Linux and macOS chapters, Hidden data, Reconstruction and recovery |
| Correlate | Analysis and correlation |
| Validate | Validation |
| Report | Confidence, reporting and defensibility |
| All of it, as checklists | Practice |
Two principles in every chapter
- Use validated tools: tools whose behaviour on the kind of input you are giving them you have tested and recorded.
- Record every significant action: the tool name, version, configuration, command, timestamps, the operator, and any error or warning encountered.
Why it matters
Nothing in this guide works without that record.
Before you move on
- You can recite the eight stages in order.
- You can say why each stage comes before the next.
- Your tools are validated for the input you are feeding them.
- Your record template covers tool, version, configuration, command, times, operator and errors.
1. Documentation, preservation
Introduction to digital forensics
In short: digital forensics turns data into facts others can rely on, and that only works if the evidence is complete, unaltered and lawfully obtained.
Know the purpose
Digital forensics is the disciplined recovery and examination of data from computers, phones, storage and online services so that it can be relied on to establish facts.
The facts usually concern who did what, when, and with which data. Can each of these be shown?
- Was a file copied to removable media?
- Was a message sent?
- Did a program run?
- Was a volume encrypted after a particular date?
The output is not a hunch. It is a set of findings, each traceable to a specific artefact at a specific location in a specific image, that a court, a tribunal, a regulator or a board can rely on and that another examiner could reproduce.
Protect integrity and stay lawful
Evidence is only useful if it can be shown to be complete, unaltered and lawfully obtained. Lose any one of those and the other side does not need to prove you are wrong, only that you might be.
- Integrity. If a file's timestamp changes because someone opened it to "have a look", you can no longer say when it was last accessed. One careless action can poison a whole device as evidence.
- Repeatability. Another examiner, given your notes and your image, must be able to reach the same result. That is what makes a finding evidence rather than an opinion.
- Authority. Searching a device or an account without the right to do so can be a criminal offence, a breach of data protection law and grounds for the evidence to be excluded. In the UK the Computer Misuse Act, UK GDPR, the Police and Criminal Evidence Act and employment law all bear on what may be inspected and by whom.
Stop and think
Get the authority in writing before you touch anything, and stay within its scope.
Follow the four principles
The UK's long-standing good practice guide for digital evidence (originally published by ACPO, the Association of Chief Police Officers) remains the best summary:
- No action should change data that may later be relied on.
- Anyone who must access original data must be competent and able to explain the relevance and implications of their actions.
- There must be an audit trail a third party could follow to the same result.
- The person in charge of the investigation is responsible for making sure all of this happens.
ISO/IEC 27037 covers the same ground internationally. In England and Wales, the Forensic Science Regulator's Code of Practice sets the standard that court-facing digital forensic work is measured against.
Example
An IT manager, asked to "check" a departing employee's laptop, logs in and browses the Downloads folder. Windows updates access times, the browser writes its own history, and a sync client uploads a batch of changes. Nothing has been deleted, but the state of the machine on the day the employee left can no longer be reconstructed with confidence. The right first move was to leave it alone and hand it to someone trained to preserve and image it.
Before you move on
- Written authority in hand, and you know its scope.
- You can state the four ACPO principles.
- Every finding you plan to make traces to a specific artefact in a specific image.
- Nobody has "had a look" at the original.