Digital forensics

How it is used

Often combined with incident response as DFIR. Key ideas are chain of custody, forensic images and preserving evidence before systems are wiped. Investigators take a forensic image and verify it with a hash.

Example sentences

1. Don't reboot the server yet; the digital forensics team needs a memory capture first.

2. The digital forensics report confirmed that the attacker was inside for nine days.

Common collocations

• forensic image
• chain of custody
• DFIR
• forensic analysis
• preserve evidence

Related terms

• incidentAn event that threatens or harms the confidentiality, integrity or availability of systems or data, such as a malware infection or an unauthorised login.
• logA file or record in which a system, application or device automatically writes down events, such as logins, errors and network connections, with the time they happened.
• hashA fixed-length value calculated from data by a one-way function. The same input always gives the same hash, but the original data cannot be rebuilt from it.
• indicator of compromiseA piece of technical evidence that suggests a system may have been attacked, such as a malicious IP address, file hash or domain name.

This word in other fields

The same English word can have a different meaning in another field:

• digital forensics · Software Engineering

More terms: Incident Response

• data breach
• backup
• containment
• playbook
• escalate
• disaster recovery