What is digital forensics?
Definition
Digital forensics is the process of finding, collecting, examining and analyzing data from computers, phones and other devices in a way that keeps the evidence intact, so it can be used to investigate an incident or in court.
- Category
- Security
- Also called
- computer forensics, cyber forensics
- Last updated
NIST's glossary gives two close definitions. One describes digital forensics as applying science to the identification, collection, examination and analysis of data while preserving the integrity of the information and keeping a strict chain of custody. The other, from NIST SP 800-86, describes the process of acquiring, preserving, analyzing and reporting on evidence with scientific methods that are reliable, accurate and repeatable enough to be used in judicial proceedings.
How it works
The steps follow the wording above. Investigators identify which devices or accounts might hold evidence. They collect the data, usually by making an exact copy so the original isn't changed. They examine the copy for deleted files, logs, messages and browsing history, then analyze what it shows and write it up. The chain of custody is a record of who handled the evidence and when, which is what makes it credible later.
Where you meet it
Companies use it after a data breach to work out how attackers got in and what they took. Police use it on phones and laptops in criminal cases. Individuals meet it in disputes, such as a company checking a work laptop, or when a victim of stalking or fraud hands a device over to investigators.
Digital forensics vs. related terms
Incident response is about stopping and recovering from an attack. Digital forensics is about working out what happened and preserving proof. They often run side by side. OSINT, by contrast, uses information that is already public and doesn't involve examining a seized device.
Why it matters to you
Deleting a file rarely makes it unrecoverable, and devices keep more than most people expect. If you're a victim of fraud or harassment, how you treat your device in the first hours can decide whether the evidence is usable.
How to protect yourself
- 1
Preserve evidence before you clean up
If you've been scammed or harassed, take screenshots and keep the original messages. Don't delete accounts or factory reset the device until you've reported it.
- 2
Don't assume deleted means gone
Before selling or recycling a phone or laptop, use the built-in erase option and turn on device encryption first.
- 3
Report to the right place
In the US, report online crimes to the FBI's IC3 at ic3.gov and fraud to the FTC. Elsewhere, use your local police or cyber crime reporting service.
- 4
Keep your accounts locked down
Strong, unique passwords and two-step verification make it harder for an attacker to leave anything for investigators to find in the first place.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is digital forensics used for?
Investigating cyber attacks, fraud, harassment and other crimes, and recovering evidence from devices for use in court or internal investigations.
Is digital forensics the same as computer forensics?
Computer forensics is the older name for the same practice. NIST's glossary lists it as a synonym.
What is chain of custody?
A record of who handled a piece of evidence and when, kept so that it can be shown nobody changed it.
Can deleted files be recovered?
Often, yes. Forensic examiners can recover files that were deleted but not yet overwritten, which is why proper erasure matters when you dispose of a device.
Sources
Something wrong or out of date? Tell us and we'll re-check it.