## What is Digital Forensics?

**Digital Forensics** is the science of identifying, preserving, recovering, analyzing, and presenting facts about digital evidence. It is CSI for computers.

### The Goal
The goal is not just "Find the bad guy". It is to answer the W-questions:
*   **Who** did it? (Attribution).
*   **What** did they do? (Actions).
*   **When** did it happen? (Timeline).
*   **How** did they get in? (Root Cause).

### Forensic Soundness (Admissibility)
In a court of law, evidence must be **admissible**.
*   If you boot up the suspect's laptop to look around, you have modified the evidence (timestamps changed, temporary files created). A defense lawyer will argue: "The analyst tampered with the device. The malware could have been planted by the analyst."
*   **Rule #1**: Never work on the original evidence. Always work on a forensic copy (Image).
*   **Rule #2**: Verify integrity using Hashes.

### Types of Forensics
1.  **Disk Forensics**: Analyzing hard drives, USBs. (Finding deleted files).
2.  **Memory Forensics**: Analyzing RAM. (Finding running malware, encryption keys, chat logs).
3.  **Network Forensics**: Analyzing PCAPs and logs.
4.  **Mobile Forensics**: iOS/Android analysis.

### Locard's Exchange Principle
"Every contact leaves a trace."
In the physical world, a burglar leaves fingerprints and takes mud on their shoes.
In the digital world, a hacker leaves logs, registry keys, and cache files, and takes data. It is impossible to interact with a system without changing it.