What Is Digital Forensics?

Abstract

This chapter introduces the concept of digital forensics and provides a discussion of what computer forensics is, examining data in order to reconstruct what happened in a digital environment. Further, the chapter discusses the steps involved in a forensic examination in a digital environment, from collecting evidence to reporting on the findings of the examination. Common constraints and processes handled during a forensics examination are also introduced. Emphasis is put on making the reader understand the reason for a computer forensic examination and the fact computer forensics follows the same rules and regulations as traditional forensic disciplines. The fact that a forensic examination is commonly initiated for a reason, answering some question, is also described. The aim of the chapter is to provide the reader with a brief and nontechnical overview of the subject digital forensics. As such, the chapter can be read and understood without any technical knowledge.