Digital Forensics

Digital Forensics: Preserving Digital Evidence and Investigating Incidents

Digital forensics involves the systematic identification, preservation, examination, and analysis of digital evidence. It helps reconstruct events, understand technical relationships, and obtain reliable findings to support operational or legal decisions.

It is used, for example, following cyberattacks, during internal investigations, or in criminal and civil proceedings. Key factors include appropriate investigative methods, careful handling of the data, and transparent documentation. The conclusions that can be drawn depend on the quality and completeness of the available evidence.

What is digital forensics?

Digital forensics examines data on computers, mobile devices, networks, applications, and cloud services. Typical questions investigated include:

• What happened, and when?
• Which systems, accounts, and data were affected?
• How did the unauthorized access occur?
• What actions were taken afterward?
• What signs point to data manipulation or a data breach?

The investigation does not have to be focused on a criminal offense. It may also be prompted by the need to investigate a security incident or a violation of internal policies.

Digital traces do not automatically provide clear-cut answers. For example, a logged access via a user account does not, on its own, prove which person actually took the action. Forensic experts therefore examine the context, cross-reference different sources, and distinguish between proven facts, plausible conclusions, and unanswered questions.

What types of digital forensics are there?

Digital forensics encompasses several fields of work that are often interconnected.

Subfield	Typical Research Topics
Computer and Data Storage Forensics	File systems, operating system artifacts, installed programs, user activities, and deleted data
Memory and Live Forensics	Ephemeral information from running systems, such as processes, network connections, and memory contents
Network Forensics	Recorded network traffic, connection data, and logs from network components
Mobile Forensics	Data and Usage Traces on Smartphones and Tablets
Cloud Forensics	Audit logs, virtual systems, cloud storage, and administrative and account-related activities
Application and Database Forensics	Business processes, data changes, transactions, and access within applications
Email Forensics	Messages, headers, attachments, forwarding rules, and activity in email accounts

Malware analysis is a related discipline. It examines how suspicious programs work and can help explain forensic findings.

How does a digital forensic examination work?

The specific procedure depends on the purpose of the study, the data sources, and the context. A structured approach includes the following steps.

1. Clarify the Mission and Authorities

At the outset, the scope of the investigation and the responsibilities involved are defined. This includes determining which systems and data may be examined and which legal requirements apply.

A clearly defined scope of work prevents unnecessary data collection and helps focus time and resources on the relevant questions.

2. Identify and prioritize data sources

Next, potential sources of traces are identified. These include, for example, end devices, servers, memory, email systems, security solutions, and cloud logs.

The backup sequence takes into account the transient nature of the data. The contents of memory may be lost when the system is shut down; logs may disappear due to short retention periods or continuous overwriting.

3. Back up your data

The backup method is selected based on the source. Options include full disk images, selective file backups, memory images, and exports from cloud services, among others.

Necessary actions and known limitations are documented. In the event of an ongoing security incident, the collection of evidence must be coordinated with damage-control measures.

4. Prepare and Analyze Data

The backed-up data is technically analyzed and checked for relevant artifacts. These include, for example, log entries, file metadata, configuration changes, and references to programs that have been run.

Time data must be carefully organized. Different time zones, varying system clocks, and tampered timestamps can affect the reconstruction.

5. Analyze and review findings

The findings of the investigation are analyzed in relation to one another. Experts reconstruct the sequence of events, test hypotheses, and consider alternative explanations.

Key conclusions should, to the extent possible, be supported by independent lines of evidence.

6. Document and report results

The final report describes the scope of the project, the data set, the methods, the findings, and the conclusions. It also identifies limitations and remaining uncertainties.

Documentation begins with the very first step and continues throughout the entire examination.

How is digital evidence secured?

Proper data preservation should preserve relevant information, minimize changes as much as possible, and ensure that the origin and handling of the data are traceable.

Appropriate Security Procedures

When storage media are powered off, a write blocker can prevent the investigating system from writing to them. Often, a forensic image is created that captures the areas of the storage medium that are readable using the selected method.

Not every data source can be backed up in this way. For live systems, mobile devices, and cloud services, different methods are required. It is not always possible to collect data without making any changes. Unavoidable changes must be minimized and documented.

Even write blockers have their limits: An SSD’s internal processes can run independently of write accesses from the test computer.

Integrity Check Using Hash Values

Cryptographic hash values—such as those based on SHA-256—make it possible to verify later whether a secured data object has been altered from its documented state.

However, a hash value does not prove either the legality of the collection or the accuracy of the content. Nor does it replace documentation of the source.

A Verifiable Chain of Evidence

The chain of custody documents how evidence is handled. This includes, in particular:

• clear labeling and origin;
• Time and circumstances of the backup;
• responsible persons;
• Transfers, accesses, and processing steps;
• Storage location and protective measures.

Stored data must be protected against unauthorized access, loss, and unintentional modification. Analyses should be performed on verified working copies whenever possible.

What are the key considerations in cloud forensics?

In cloud environments, physical storage media are often not available. Instead, audit logs, data exports, snapshots, and information about accounts or permissions are examined.

The available tracks depend on the specific service, its configuration, and the existing access rights. Important questions include:

• What events are logged?
• How long will the logs remain available?
• What data can be exported, and what permissions are required?
• What kind of support must the provider offer?
• What are the legal requirements governing access and transmission?

A cloud snapshot does not automatically constitute a complete backup of all relevant traces. Activities in identity services or administrative interfaces may also be critical to the investigation.

What tools are used in digital forensics?

Forensic tools support a variety of tasks. The choice of tool depends on the data source, the purpose of the investigation, and the required functionality.

Tool or Product Family	Typical application
OpenText Forensic, from the former EnCase portfolio	Investigation of digital evidence and data storage media
Exterro FTK	Processing, Searching, and Analyzing Large Datasets
FTK Imager	Creation and verification of disk images, as well as data preview
Autopsy	Open-source platform for analyzing digital artifacts
Cellebrite UFED and Inseyets	Mobile data collection and analysis, depending on the device and supported methods
Wireshark	Recording and Analysis of Network Packets

In addition, tools for memory analysis, timeline generation, and the evaluation of cloud logs are used.

A well-known product name does not guarantee error-free results. Tools must be suitable for their intended purpose. Versions, settings, and relevant limitations should be documented, and important findings should be cross-checked whenever possible.

What skills do digital forensic investigators need?

Digital forensics combines technical knowledge with methodological rigor. Key competencies include:

• Knowledge of operating systems, file systems, networks, and applications;
• Understanding of cloud services, identities, and permissions;
• proficient use of forensic tools;
• Programming and scripting skills for targeted data processing;
• Ability to test hypotheses and alternative explanations;
• Understanding of the legal framework;
• Clear documentation and communication.

It is equally important to recognize the limits of what can be concluded. Professionals must be able to distinguish between an observed artifact and its interpretation. In complex investigations, technical specialists, incident response teams, and legal representatives work together.

How are digital forensics and cybersecurity related?

Cybersecurity encompasses prevention, detection, response, and recovery. Digital forensics provides methods for investigating incidents and determining what happened based on digital evidence.

In the event of a security incident, a forensic investigation helps determine, for example, the attack vector and the extent of the impact. Incident response uses these findings to contain the incident, address the root causes, and restore secure operations.

This collaboration is often referred to as Digital Forensics and Incident Response (DFIR).

Forensics also has a preparatory aspect: Companies can take steps even before an incident occurs to ensure that appropriate evidence can be collected and, if necessary, preserved.

What does “forensic readiness” mean?

“Forensic Readiness” refers to the organizational and technical preparations for potential forensic investigations.

These include:

• Appropriate logging of relevant events;
• reliable time synchronization;
• proper storage and secure safekeeping;
• defined responsibilities and reporting channels;
• predefined backup procedures;
• Clearly defined access rights and legal framework;
• Tools that are inspected regularly and trained staff.

Preparation improves the conditions for an investigation. However, it does not mean storing as much personal data as possible indefinitely. The scope and retention of such data must be necessary, appropriate, and legally permissible.

What legal considerations need to be taken into account?

A forensic investigation requires a clear mandate and a sound legal basis. This is especially true when personal data is processed.

Within the scope of the GDPR, requirements such as purpose limitation, data minimization, storage limitation, and appropriate security measures must be observed. Additional requirements may apply to employee data. Section 26 of the BDSG sets forth specific conditions for the detection of criminal offenses in the context of an employment relationship.

Depending on the circumstances, confidentiality obligations, participation rights, and requirements for international data transfers must also be reviewed.

In the event of data breaches, any reporting obligations must be assessed regardless of whether the forensic investigation has been completed. Provided that the requirements of Article 33 of the GDPR are met, the breach must be reported to the competent supervisory authority without delay and, if possible, within 72 hours of becoming known.

Careful preservation and documentation support the lawful use of the results. However, they do not guarantee admissibility in court. Admissibility depends on the specific case, the proceedings, and the legal circumstances.

What are some typical use cases?

Digital forensics can support the following types of investigations, among others:

• Ransomware: Reconstruct the attack vector, affected systems, and possible activities prior to encryption.
• Account Takeovers: Investigate unauthorized logins, sessions, and subsequent actions.
• Suspected Data Leak: Investigate any indications of access, compilation, or transmission of confidential information.
• Internal Investigations: Evaluate grounds for suspicion in a transparent manner, taking into account the legal requirements.
• Manipulation of business data: Investigate changes to databases, documents, or transactions.
• Criminal and civil proceedings: Securing digital evidence and analyzing it from a technical perspective.

The investigation may confirm, refute, or leave open a suspicion due to a lack of sufficient data. The absence of evidence does not automatically prove that an event did not occur.

Can deleted data be restored?

Deleted data can be recovered under certain conditions. There is no general guarantee of success.

With traditional magnetic hard drives, data may initially remain intact after deletion as long as the relevant storage sectors have not been overwritten. With SSDs and other flash storage devices, TRIM and internal memory cleanup can significantly limit the ability to recover data.

Other factors that influence this include encryption, the condition of the device, the file system, the deletion method, and any use of the device since the deletion.

If the original content is no longer available, other sources may be helpful: backups, version histories, synchronized copies, email attachments, or application logs.

It is important to distinguish between the complete recovery of a file and the reconstruction of individual pieces of information about that file.

Can encrypted data and passwords be retrieved?

That depends on the security procedure and the available access options.

Encrypted data can, for example, be accessed using existing keys or valid credentials. However, strong, properly implemented encryption can prevent the data from being decrypted without the appropriate keys.

Password hashes are not decrypted. Under certain conditions, potential passwords can be checked against an existing hash. Whether this is successful depends, among other things, on the password strength and the hashing algorithm used.

Forensic tools therefore do not provide universal access to locked devices or protected data.

How long does a forensic examination take?

The duration depends on the scope of the project and the technical constraints. The following factors are particularly important:

• Number and type of affected systems;
• Scope and quality of the available data;
• Access Options and Encryption;
• necessary coordination with third parties;
• Depth of analysis and report requirements.

An initial technical assessment can be available much sooner than a completed investigation. Complex cases can take weeks or months.

A single smartphone is not necessarily examined more quickly than a server. Barriers to access and the scope of the investigation can carry more weight than the sheer volume of data.

A reliable schedule can therefore only be drawn up after an initial narrowing down of options.

What does a digital forensic examination cost?

The costs depend on the specific scope of services. Without a case description, a general price estimate is of limited value.

A transparent offer should specify:

• which systems and data sources are included;
• which questions should be answered;
• how data is backed up and analyzed;
• how urgent the matter is;
• which reports and other services are included;
• how additional work is coordinated.

A phased approach to commissioning can help manage the workload: An initial narrowing of the scope is followed by a targeted exploration of the relevant issues.

What should companies do if they suspect an incident has occurred?

Companies should use the designated reporting channel and involve the appropriate security or incident response personnel. Observations, timestamps, and actions already taken should be documented.

Uncoordinated deletions, reinstallations, reboots, or independent attempts at recovery can alter or destroy relevant evidence. Whether a system should be isolated, kept running, or shut down must be decided based on the specific threat and the available evidence.

Damage control and preserving evidence go hand in hand. Early professional coordination helps prevent further damage and lays the groundwork for a solid investigation.

Sources and Further Information

Last updated: October 2026

• NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response – Fundamentals of Forensic Investigations in an IT Context.
• NIST IR 8387: Digital Evidence Preservation – Preservation and Integrity of Digital Evidence.
• NIST SP 800-201: Cloud Computing Forensic Reference Architecture – Cloud Forensics and Preparation for Investigations.
• NIST SP 800-61 Rev. 3 – Integrating Incident Response into Cybersecurity Risk Management.
• Solid-State Drive Forensics: Where Do We Stand? – Research on the unique aspects of SSD forensics.
• General Data Protection Regulation, in particular Articles 5, 6, 32, and 33.
• § 26 BDSG – Processing of Employee Data.
• OpenText: Further development of the EnCase portfolio, Exterro FTK, Autopsy, Cellebrite Inseyets, and Wireshark —information from the manufacturers and projects.

Zurück zur Übersicht des Glossars