Module 1: Forensics Foundations

What Digital Forensics Covers

Every action on a computer, phone or online service leaves traces: a file timestamp, a log entry, a cached web page, a database row in a messaging app. Digital forensics is the discipline of finding, preserving, analysing and presenting those traces so that they can answer questions reliably. Those questions might come from a court, an employer, an insurer, a regulator or your own security team trying to understand an intrusion. If the work is done carelessly, evidence can be altered, conclusions can be wrong, and an innocent person can be blamed or a guilty one can walk away. That is why forensics is built on method, not on clever tricks.

The branches of digital forensics

The field is usually divided by the type of evidence source:

• Computer forensics: desktops, laptops and servers, including hard drives, solid state drives and removable media.
• Mobile forensics: smartphones and tablets, which hold messages, call logs, location history and app data such as WhatsApp or M-Pesa transaction messages.
• Network forensics: packet captures, firewall logs, proxy logs and flow records that show communication between systems.
• Memory forensics: the contents of RAM, which can reveal running processes, network connections and malware that never touched the disk.
• Cloud and application forensics: audit logs and data held by services such as email platforms, file sharing services and cloud consoles.

In practice, most investigations combine several branches. A phishing case may start with an email header, move to a laptop where malware ran, and end in firewall logs showing data leaving the network.

Forensics and incident response

You will often hear the term DFIR: digital forensics and incident response. Incident response focuses on containing and recovering from an attack quickly. Forensics focuses on establishing what happened, with evidence that can be defended. The two pull in slightly different directions. A responder wants to wipe and rebuild an infected server today; an examiner wants to image it first. Good organisations agree in advance which systems must be preserved before recovery, so that speed and evidence are both protected.

The investigation lifecycle

Most published models, including the stages described in NIST Special Publication 800-86, follow the same broad sequence:

1. Identification: work out what happened at a high level, which devices and accounts might hold relevant data, and what questions the investigation must answer.
2. Preservation and collection: secure the evidence and make forensic copies without changing the original.
3. Examination: process the copies with tools to extract relevant data, recover deleted items and filter out noise.
4. Analysis: interpret the data, correlate sources and test hypotheses against the evidence.
5. Reporting: present findings, methods and limitations clearly to the people who need them.

Throughout every stage you keep notes and a chain of custody record, which you will learn about in the next lesson.

Worked example: a suspicious payment change

A small logistics company in Nairobi pays a supplier KES 850,000, but the supplier says it never received the money. The finance officer's email shows a message, apparently from the supplier, giving new bank details. The managing director asks you to find out what happened.

You start with identification. The questions are: was the email genuine, did someone access the finance officer's mailbox, and was the officer's laptop compromised? Relevant sources are the mailbox and its audit logs in the email service, the laptop, and the company firewall logs. For preservation, you export the email with full headers, ask the email administrator to preserve the audit logs before they expire, and image the laptop before anyone reinstalls it. During examination, you parse the headers, review sign-in logs and run the laptop image through analysis tools. Your analysis might show that the email came from a look-alike domain registered two days earlier, that the mailbox had a forwarding rule created from an unfamiliar location, and that the laptop shows no malware. Your report then states these findings, the evidence behind each, and what you could not establish.

Notice that you answered specific questions. Forensics is not "look at everything"; it is structured enquiry driven by questions.

Common mistakes to avoid

• Investigating on the original device. Opening files or running tools on a suspect machine changes timestamps and can destroy evidence.
• Starting without clear questions. Without a defined scope you waste time and may collect data you have no right to see.
• Jumping to conclusions. A file on a computer does not prove a particular person put it there. Evidence must be tied to people and times carefully.
• Working without authority. You must have legal or organisational permission to examine a device or account. Enthusiasm is not authorisation.