The more we come to rely on technology for our businesses and lives, the more we expose ourselves to unexpected vulnerabilities. Computers and mobile phones offer some of the most advanced technical marvels, but they also allow criminal hackers to destabilize elections, steal identities and perform all other manners of malfeasance without revealing themselves. The science of digital forensics is a way to combat these behaviors and criminals.
Digital Forensics as a Process
Digital Forensics is an investigatory process for collecting, preserving, analyzing, and then presenting evidence to aid in criminal investigations. Forensic pathologists may use cadavers to reveal the specifics behind a murder, but digital forensics explore how machines and computers are used in the commission of other crimes.
Digital Forensics as a Science
The what, how, and why behind the science can be interesting. As a process, it follows very specific steps. First is the acquisition of evidence, in this case a data repository. Specific protocols are used during the collection to remove the possibility of data corruption. Once the data repository is in hand, it is usually imaged to allow deep analysis without destroying or compromising the original data. Passwords, individual files, trails through the web, and more items of interest can be cherry-picked from the image as required to help the investigators in their evidence accumulation. Sometimes, specific files are not even necessary; metadata can provide a lot of information all on its own.
Digital Forensics as a Strategy
A missing or encrypted file is no deterrent to a digital forensics investigation. There are several technologies that allow the digital forensics expert access to these kinds of files. Encryption performed through technologies owned by the suspect are generally easier to decrypt, since keys are often present that expedite the opening of such files. Likewise, deleted files can be recovered even in those cases where the memory sectors that held the files are overwritten. The investigator has many tools on hand to recover lost or even crack open files encrypted by unknown sources.
The science of digital forensics is a benefit to society. Although it is not a deterrent, per se, it remains a powerful tool to prosecute predators and criminals after they have committed crimes.