Digital forensics

The field divides into forensics of computers and servers, mobile devices, network traffic, cloud services and memory, and it also covers the analysis of embedded systems and vehicles. All share the same rule: work is done on verified copies, every step is documented, and findings are clearly separated from interpretation.

The process begins with identification and preservation — the device must be isolated, remote wiping prevented, and a decision made on whether volatile data require acquisition from a running system. Acquisition follows, using write protection and hash computation, then analysis: file system metadata, system and application logs, traces of use, recovery of deleted data, construction of an event timeline and correlation across sources. It concludes with a report that must be intelligible to a non-technical reader as well.

The method has clear limits. Encryption, data held in cloud services outside the organization's control, short log retention periods and remote wipe capability can put data out of reach. The legal boundary matters just as much: examining employees' devices and accounts is processing of personal data, so it requires a legal basis, must be proportionate and defined in scope in advance, and should as a rule be governed by an internal policy that employees are aware of. Private communications enjoy additional protection.

In practice forensics is the reactive part of incident response and is closely tied to it. Containment and evidence preservation are often in tension — rebuilding or cleaning a system can destroy traces — so it must be decided in advance which objective takes precedence for which type of case. Evidence is handled under chain-of-custody rules regardless of whether the case will end up in court.