resources 9 Primers 9 What is Digital Forensics?

What is Digital Forensics?

A brief overview of computer forensics, mobile forensics, and other types of digital investigation.


Digital forensics is the application of scientific tests or techniques to collect digital evidence in connection with litigation or other types of investigation. It is an integral part of the legal discovery process, but can also be a valuable tool for avoiding or shortening litigation.

Digital forensics is typically divided into sub-specialties by data source. For example, computer forensics involves collection of data from desktops and laptops. Similarly, mobile forensics involves collection of data from cellphones and tablets. There are many other potential sources of data including email, social media, and cloud storage. A thorough investigation often involves examination of multiple sources of data and careful comparison of the information collected from each.

Digital Forensics Can Enhance an Investigation

An experienced digital forensics team can:

  • collect email, text, and other communications;
  • find critical documents;
  • recover deleted communications and files; and
  • determine the activities of a specific user at a specific time.

Most importantly, forensic investigators can make connections between disparate documents, communications, logs, and data artifacts to help the client draw conclusions about what may have occurred in their case.

Digital Forensics Requires Expertise

Digital forensics teams use specialized equipment and software to collect and examine devices without changing the data or the metadata (such as the last modified time or the document author). This prevents the client from relying on data that was inadvertently modified in the investigation. The advanced tools and years of experience also help forensic examiners collect data that has been deleted or corrupted, as well as system data that is not normally accessible to a user.

This specialized scientific approach protects the integrity of the data and ensures it is admissible in court.

Related Articles

Accessing Evidence From Windows Prefetch

Accessing Evidence From Windows Prefetch

Windows Prefetch Accessing Prefetch Files for Forensic Analysis. A digital forensic investigation often aims to determine the activities of a user on a computer. Prefetch files are an important type...

read more
Collecting from Office 365

Collecting from Office 365

Collecting from Office 365 Office 365 offers eDiscovery and searching within the platform, for administrators or any authorized users to run searches and review/monitor user activity.Content Search...

read more


Give us a call at (855) 839-9084

Or send us a message and we’ll get back to you right away.