What is the the term digital forensics with example?

Answer 1

Digital forensics is the acquisition, authentication, and analyzation of digital evidence found on electronic devices.

Acquisition is simply evidence gathering. Much like a crime scene investigator will grab evidence from the scene of a crime, so must the digital forensics operator. Electronic equipment will be photographed to show the state of the machine at the time of acquisition, devices and cables will be labeled, and forensic tools (both hardware and software) will be used to create forensic images. A forensic image differs from standard file copying, in that a block by block copy of the suspect device is created instead of just copying individual files and folders. All forensic analysis is performed on the copies so that the original evidence is preserved.

Authentication is the application of a hashing algorithm, such as MD5 or SHA-1, to the original evidence and copies to create digital fingerprints. By comparing the fingerprints, examiners will know if any alterations have been made to the evidence during the analysis process. Seemingly identical documents will have different hashes if even one character in the document is altered, and the examiner must be able to validate his methods.

Analysis is the examination of the acquired and authenticated evidence using tools designed to find hidden or obscured data. Much like a data recovery service can perform a blanket recovery of a digital device to restore lost or damaged files, the forensic analysis tools dig even deeper, and can perform powerful sorting of evidence to present an easily interpreted summary of evidence. MacForensicLab actually has an image sorter with the ability to sort images by skintone - a valuable benefit to any examiner looking for evidence of child pornography or other abuse.