What Is Digital Forensics?

Digital forensics is the systematic recovery and analysis of evidence from computer systems. In security work it answers the questions an incident raises: how access was obtained, what was done, what was taken, and when it started.

It differs from ordinary troubleshooting in that the findings may need to withstand challenge — by a regulator, an insurer, an opposing party or a court — which constrains how the work is done.

What it is asked to establish

Initial access, because eradication depends on it. Timeline, because notification obligations depend on when exposure began. Scope, meaning which systems and which data were reached. And persistence, meaning what would still be there after a rebuild.

Attribution is occasionally requested and is rarely achievable to a useful standard. Technique matters more than identity for every decision that follows.

Order of volatility

Evidence disappears at different rates. Memory contents vanish on power loss. Network connections and running processes vanish when the process ends. Temporary files are overwritten. Disk contents persist longest.

That ordering dictates sequence: capture memory before disk, and capture before doing anything that changes state. Rebooting a suspect system destroys the most informative evidence available.

The artefacts that carry most of the answer

Endpoint process execution records, which show what ran and what spawned it. Authentication logs, which show which credentials were used from where. Network metadata, which shows where data went. Scheduled tasks, services and startup entries, which show persistence.

Modern endpoint platforms record much of this continuously, which has made reconstruction substantially faster than traditional disk-image analysis alone.

Cloud forensics is a different problem

There is no disk to image. Evidence consists of control plane logs, platform audit records and whatever the provider retains, and the depth available depends on what was enabled before the incident.

Retention frequently defaults to short windows, and enabling detailed audit logging after an incident produces nothing about what already happened. This is the most consequential cloud configuration decision most organisations never revisit.

When to bring in specialists

Where findings may be contested, where the intrusion is complex, where insurance or regulatory reporting depends on the conclusions, or where internal staff lack the tooling. A retainer secures availability, and availability is the constraint when several organisations are responding to the same campaign.

The work also needs independence. Internal staff investigating an incident involving systems they administer are in an awkward position regardless of their integrity.

What it costs and how long it takes

Specialist investigation is charged at senior consulting rates and a meaningful intrusion investigation runs to weeks rather than days. Scope drives the figure: a single compromised laptop is a contained exercise, while establishing what was accessed across a domain-wide compromise is a substantially larger one.

Insurance frequently covers it, and frequently only when an approved provider is engaged and notice was given promptly. Checking those policy conditions before an incident avoids a choice between the responder you want and the coverage you paid for.

Where to start

Check your cloud audit log retention and your endpoint telemetry window. Those two settings determine how far back any investigation can see, and both are usually shorter than an intrusion.

See evidence collection and investigation. GuardsArm delivers incident response.