# Introduction to Digital Forensics

If Incident Response is the act of putting out the fire, Digital Forensics is the investigation into how the fire started, who started it, and what was burned.

**Digital Forensics** is the application of scientific investigation applied to digital crimes and attacks. It involves the recovery, investigation, examination, and analysis of material found in digital devices.

## The Goal of Forensics
While Incident Responders just want to get the business back online as fast as possible, Forensic Investigators care about:
1.  **Truth:** Establishing exactly what occurred.
2.  **Attribution:** Finding out *who* did it (Internal threat? Nation state? Ransomware gang?).
3.  **Impact Analysis:** Determining exactly what data was accessed, stolen, or destroyed.
4.  **Legal Admissibility:** Ensuring the collected evidence holds up in a court of law.

## Major Branches of Digital Forensics

### 1. Computer/Disk Forensics
The classic discipline. This involves taking a physical or logical "image" (a bit-by-bit exact copy) of a hard drive or SSD.
*   **What we look for:** Deleted files, browser history, illegal media, timeline of accessed documents, registry modifications.
*   **Tools:** Autopsy, EnCase, FTK (Forensic Toolkit).

### 2. Memory (RAM) Forensics
Hard drives are slow and persistent. Modern, sophisticated malware often runs entirely in Random Access Memory (RAM) to avoid leaving traces on the hard drive. 
*   **What we look for:** Decrypted passwords, active network connections, injected malicious code, running processes.
*   **Tools:** Volatility, Rekall.

### 3. Network Forensics
Analyzing network traffic to reconstruct events. It's often said that "packets don't lie." Even if an attacker deletes the logs on a compromised server, the network traffic capturing their activity might still exist.
*   **What we look for:** Data exfiltration (large uploads), Command and Control (C2) beacons, unencrypted credentials.
*   **Tools:** Wireshark, Zeek, Suricata, Arkime.

### 4. Mobile Forensics
Smartphones are essentially highly personal computers. They are often critical in criminal investigations or corporate espionage cases.
*   **What we look for:** SMS/WhatsApp messages, GPS locations, application usage, call logs.
*   **Tools:** Cellebrite, Magnet AXIOM.

## The Friction: Speed vs. Preservation
There is an inherent conflict between IT/Business Operations and Digital Forensics.

*   **The Business:** "The server is hacked! Nuke it, format the drive, and restore from backups so we can make money again!"
*   **Forensics Analyst:** "Stop! Don't touch the server! Don't even power it off! If you reboot it, we lose the RAM! Let me take a 4-hour forensic image first over the network."

A mature Incident Response plan balances these two conflicting needs, outlining exactly when a full forensic investigation is required vs. when rapid recovery is prioritized.