thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Digital Forensics

The scientific collection, preservation, analysis and presentation of digital evidence in a legally defensible manner.

Definition

Digital forensics supports incident response, litigation, HR investigations and law enforcement. The process typically follows identification, preservation, collection, examination, analysis and reporting, maintaining integrity through hashing, write blockers and chain of custody. Disciplines include disk, memory, network, mobile and cloud forensics.

Example

Imaging a laptop's drive and analyzing browser history to determine whether data was uploaded to a personal site.

Exam tip

Forensic questions emphasize integrity: hash the evidence, work on copies, document chain of custody.

Related terms