Digital Forensics

I. Overview link

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
    A["Digital Data\n(Raw Data)"] -- "Scientific investigation and proof of integrity" --> B["Legal Evidence\n(Admissible in Court)"]
    style A fill:#f9f9f9,stroke:#333,stroke-width:3px
    style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A scientific investigation and examination technique that collects, recovers, and analyzes electronic data stored on digital devices such as computers, smartphones, and cloud services in order to use it as legal evidence.

Features:
( Integrity ) Proves through means such as hash ( Hash ) values that collected evidence has not been altered or forged during the analysis process
( Chain of Custody ) Chain of Custody: maintains a record of every path and person responsible, from evidence collection through submission to the court
( Reproducibility ) Ensures the objectivity that analyzing with the same tools and procedures must yield the same results
( Legitimacy ) Preserves the legal admissibility ( Admissibility ) of evidence by complying with due process and the principle of judicial warrants

II. Mechanism & Components link

flowchart LR
    A["Digital Forensics\nFive Core Principles"] --> B["Legitimacy\nDue process / judicial warrant"]
    A --> C["Reproducibility\nSame conditions, same results"]
    A --> D["Promptness\nImmediate collection of volatile data"]
    A --> E["Chain of Custody\nComplete custody record"]
    A --> F["Integrity\nProven via hash values"]

The five-step process for carrying out a digital forensic investigation while preserving the evidentiary value of the evidence is as follows.

III. Advanced Topics & Comparison link