Study Of Digital Forensics Process

1. Study of the Digital Forensics Process
DIGITAL FORENSIC PROCESS
Like any other branch of applied science, digital forensics has its protocols and a structured
process. It can be divided into five stages: identifying, preserving, analyzing, documenting,
and representing steps.
Digital forensics plays a crucial role in investigating financial crimes in today's digital age.
This case study delves into the digital forensics process in India concerning financial
research, highlighting its methodologies, challenges, and outcomes. By focusing on a
hypothetical case involving financial fraud, this study elucidates how digital forensics
techniques are applied to uncover evidence, analyze data, and support legal proceedings in
the Indian context.
Abstract: This case study delves into the application of digital forensics in the context of
financial fraud investigation in India. It examines a real-life scenario involving fraudulent
activities within a financial institution and demonstrates how digital forensics methodologies
were employed to uncover evidence, identify perpetrators, and support legal proceedings. The
study underscores the importance of digital forensics in combating financial crimes and
highlights its efficacy in the Indian regulatory landscape.
Introduction: Financial fraud poses significant challenges to businesses and regulatory
authorities, necessitating robust investigative techniques. With the proliferation of digital
transactions, digital forensics has emerged as a critical tool in unraveling complex financial
crimes. This case study elucidates the digital forensics process in India, focusing on its role in
investigating financial fraud and ensuring accountability.
Case Scenario: A leading bank in India detected irregularities in its financial records,
indicating potential fraud. Suspicious transactions, unauthorized access to sensitive data, and
discrepancies in accounting led the bank to initiate a digital forensics investigation. The

2. objective was to identify the perpetrators, determine the extent of the fraud, and gather
evidence for legal action.
Digital Forensic Process:-
In the context of digital forensics, "identification" refers to the initial phase of
the investigation process where investigators identify and recognize the
existence of a potential cyber incident, crime, or security breach. This phase is
critical as it sets the foundation for subsequent forensic activities. Here's an
explanation of the identification phase:
Identification Phase:
Awareness of Incident: Identification begins with the awareness of an incident
or anomaly that triggers suspicion of a cybercrime or security breach. This
awareness can arise from various sources, including:
 Reports from system users or administrators about suspicious activities or
anomalies.
 Alerts generated by security monitoring systems, intrusion detection
systems, or antivirus software.
 Media reports, public disclosures, or external notifications about security
incidents.
 Routine system audits, security scans, or penetration tests that uncover
irregularities.
Initial Assessment: Upon receiving information about a potential incident,
investigators conduct an initial assessment to determine its nature, scope, and
potential impact. This assessment involves:
 Gathering information about the reported incident, including its timing,
location, and affected systems or assets.
 Assessing the credibility and reliability of the source reporting the
incident.
 Evaluating the severity and urgency of the incident to prioritize response
efforts.

3. Confirmation: Once the initial assessment is complete, investigators seek to
confirm the existence of the incident through further investigation and analysis.
This may involve:
 Verifying the reported symptoms or indicators of the incident through
direct observation or examination of digital evidence.
 Collecting additional information, logs, or artifacts from relevant
systems, networks, or devices to corroborate the initial reports.
 Consulting with subject matter experts, forensic analysts, or other
stakeholders to validate the findings and interpretations.
Documentation: Throughout the identification phase, investigators document
all relevant information, observations, and actions taken to establish a clear
record of the incident. Documentation helps ensure transparency, accountability,
and continuity in the investigation process. It may include:
 Incident reports, logs, or tickets documenting the initial report,
assessment, and confirmation of the incident.
 Records of communications, meetings, or interviews with involved
parties, witnesses, or stakeholders.
 Captured screenshots, system snapshots, or other visual documentation of
observed anomalies or evidence.
Importance of Identification:
Timely Response: Prompt identification of incidents enables swift response
and containment, minimizing the potential impact on affected systems and data.
Preservation of Evidence: Early identification helps preserve digital evidence
and prevent its alteration, deletion, or destruction, ensuring its integrity and
admissibility in legal proceedings.
Risk Mitigation: Identifying incidents early allows organizations to assess and
mitigate risks associated with cyber threats, vulnerabilities, or breaches,
reducing their exposure to potential harm or losses.
Compliance Requirements: Many regulatory frameworks and industry
standards mandate timely identification and reporting of security incidents to
comply with legal, contractual, or regulatory obligations.
2. Preservation-

4. In digital forensics, "preservation" refers to the process of identifying, securing,
and maintaining the integrity of digital evidence to ensure its admissibility and
reliability in subsequent forensic analysis and legal proceedings. Preservation is
a critical phase in the investigative process, as it involves safeguarding potential
evidence from alteration, deletion, or contamination. Here's an explanation of
the preservation phase:
Preservation Phase:
1. **Identification of Potential Evidence:**
Preservation begins with the identification of potential digital evidence
relevant to the investigation. This evidence may include:
- Data stored on computer systems, servers, mobile devices, or other digital
media.
- Network traffic logs, communication records, or system activity logs.
- Electronic documents, files, emails, or messages.
- Metadata associated with digital files, such as timestamps, file properties,
and user attributes.
2. Documentation and Logging:
Investigators document and log all relevant information about the identified
evidence, including:
- Description and location of the evidence (e.g., file path, storage device,
network location).
- Timestamps indicating when the evidence was discovered or accessed.
- Chain of custody information, documenting who handled the evidence and
when.
- Observations or contextual information about the evidence's significance to
the investigation.

5. 3. Securing the Scene:
Investigators take steps to secure the physical and digital environment where
the evidence is located to prevent unauthorized access, tampering, or
contamination. This may involve:
- Securing access to physical premises, server rooms, or other locations
containing digital evidence.
- Implementing access controls, encryption, or other security measures to
protect digital evidence from unauthorized access or modification.
- Documenting the current state of the environment, including system
configurations, network topology, and device settings.
4. Creating Forensic Copies:
To preserve the integrity of digital evidence, investigators create forensic
copies, also known as forensic images or clones, of the original data. These
copies are exact replicas of the original evidence and are created using
specialized forensic tools or hardware write-blocking devices to prevent
alterations to the original data. Key considerations for creating forensic copies
include:
- Verifying the integrity of the forensic copies through cryptographic hash
functions or checksums.
- Documenting the process of creating forensic copies, including the tools
used, timestamps, and any deviations from standard procedures.
- Storing the forensic copies in a secure location to prevent accidental loss,
damage, or tampering.
Importance of Preservation:
- Maintaining Integrity:

6. Preservation ensures the integrity and authenticity of digital evidence by
preventing unauthorized alterations, deletions, or contamination.
- Legal Admissibility:
Proper preservation of evidence helps establish a clear chain of custody and
documentation trail, enhancing its admissibility and reliability in legal
proceedings.
- Forensic Analysis:
Preserved evidence serves as the foundation for subsequent forensic analysis,
enabling investigators to conduct thorough examinations and draw reliable
conclusions.
- Protection Against Spoliation:
Preservation safeguards digital evidence from spoliation, ensuring that it
remains intact and available for examination, regardless of future developments
in the investigation or legal proceedings.
Collection Phase:
Scope Definition: Before initiating the collection process, investigators define
the scope of the investigation and identify the types of digital evidence that may
be relevant. This involves:
Understanding the nature of the incident or crime under investigation.
Identifying the potential sources of digital evidence, such as computers, mobile
devices, servers, network logs, and cloud storage.
Determining the legal and technical requirements for collecting and handling
digital evidence, including compliance with privacy laws and regulations.
Selection of Collection Methods: Based on the scope and requirements of the
investigation, investigators select appropriate methods for collecting digital
evidence. These methods may include:
Forensic imaging: Creating forensic copies (bit-for-bit copies) of storage
devices using specialized software or hardware write-blocking devices to
preserve the integrity of the original data.

7. Live analysis: Conducting real-time analysis of running systems, networks, or
devices to gather volatile data, such as active processes, network connections,
and system logs.
Network capture: Capturing network traffic using packet capture tools or
network monitoring solutions to analyze communication patterns, data
exchanges, and potential security breaches.
Data extraction: Extracting specific types of data from digital devices or storage
media using forensic software tools or manual examination techniques, such as
keyword searches, file carving, or registry analysis.
Execution of Collection Procedures: Investigators execute collection
procedures according to established protocols and guidelines, ensuring the
proper handling and preservation of digital evidence. This involves:
Identifying and accessing target systems, devices, or data repositories for
collection.
Using approved tools, techniques, and procedures to acquire digital evidence
while minimizing the risk of alteration or contamination.
Documenting the collection process, including timestamps, locations, and
descriptions of collected evidence, to maintain an auditable trail and support
chain of custody requirements.
Verification and Validation: After collecting digital evidence, investigators
verify and validate its integrity and completeness to ensure its reliability and
admissibility. This includes:
Verifying the integrity of forensic images or collected data through
cryptographic hash functions or checksums to detect any alterations or
tampering.
Conducting validation checks to confirm that all relevant data has been
collected and that no critical evidence has been overlooked or omitted.
Documenting verification and validation procedures, as well as any deviations
or discrepancies encountered during the collection process.
Importance of Collection:

8. Preservation of Evidence: Collection ensures the preservation of digital
evidence in a manner that maintains its integrity, authenticity, and admissibility
for forensic analysis and legal proceedings.
Thorough Investigation: Proper collection of digital evidence enables
investigators to conduct thorough examinations and analyses, uncovering
relevant facts, insights, and leads to advance the investigation.
Legal Compliance: Adhering to established collection procedures and
guidelines helps ensure compliance with legal and regulatory requirements,
enhancing the validity and acceptability of collected evidence in court.
Protection Against Contamination: Careful collection procedures minimize
the risk of contamination or alteration of digital evidence, preserving its
evidentiary value and reliability for investigative and prosecutorial purposes.
In digital forensics, the examination phase involves the systematic analysis and
inspection of digital evidence collected during the investigation. This phase is
crucial for uncovering relevant information, identifying patterns, and extracting
actionable insights to support the investigation's objectives. Here's an
explanation of the examination phase:
Examination Phase:
1. Data Analysis Planning:
Before diving into the examination process, forensic examiners develop a
detailed plan outlining the objectives, scope, and methodologies for analyzing
the collected digital evidence. This includes:
- Defining examination goals and hypotheses based on the nature of the
investigation and the information sought.
- Identifying the types of digital evidence to be analyzed, such as files, logs,
metadata, network traffic, or system artifacts.
- Selecting appropriate tools, techniques, and methodologies for conducting
forensic analysis, considering factors such as data volume, complexity, and
relevance.

9. 2. Data Processing and Preparation:
Forensic examiners process and prepare the collected digital evidence for
analysis, ensuring that it is organized, structured, and ready for examination.
This involves:
- Reviewing and cataloging the collected evidence, including verifying its
integrity and completeness.
- Converting raw data into a usable format for analysis, such as extracting
files from forensic images or converting log files into a standardized format.
- Organizing and categorizing evidence based on relevance, source, or
investigative priority to facilitate efficient examination and analysis.
3. Evidence Examination and Analysis:
Forensic examiners conduct a comprehensive examination and analysis of the
digital evidence to uncover relevant information, identify patterns, and extract
insights. This involves:
- Using specialized forensic tools and techniques to examine digital artifacts,
files, system logs, and other evidence sources.
- Identifying and extracting relevant information, such as user activity, file
access patterns, communication records, and suspicious behaviors.
- Analyzing metadata, timestamps, file attributes, and other contextual
information to reconstruct events, timelines, and sequences of activities.
- Applying data mining, statistical analysis, and visualization techniques to
identify correlations, anomalies, or trends in the data that may be indicative of
suspicious or criminal behavior.
4. Interpretation and Corroboration:

10. Forensic examiners interpret the findings from the examination and correlate
them with other pieces of evidence to build a cohesive narrative or
understanding of the case. This involves:
- Formulating hypotheses and theories based on the analysis of digital
evidence and other investigative findings.
- Corroborating digital evidence with witness statements, physical evidence,
or other sources of information to validate findings and conclusions.
- Documenting interpretations, observations, and analytical insights to support
the investigation's findings and conclusions.
5. Reporting and Documentation:
Forensic examiners document their findings, observations, and conclusions in
a comprehensive report that communicates the results of the examination to
stakeholders. This includes:
- Summarizing key findings, analysis methodologies, and examination results
in a clear and concise manner.
- Providing supporting evidence, artifacts, and documentation to substantiate
findings and conclusions.
- Adhering to established reporting guidelines, formats, and standards to
ensure the report's accuracy, completeness, and credibility.
Importance of Examination:
- Discovery of Relevant Information: The examination phase uncovers valuable
insights, patterns, and evidence from digital data, providing critical information
to advance the investigation and support decision-making.
- Identification of Suspect Activities: By analyzing digital evidence, examiners
can identify suspect activities, behaviors, or patterns indicative of criminal
conduct, enabling law enforcement agencies to take appropriate action.

11. -Corroboration and Validation: Examination findings help corroborate and
validate other investigative findings, providing additional evidence to support
investigative theories, conclusions, and legal proceedings.
- Case Resolution: Through thorough examination and analysis, forensic
examiners contribute to the resolution of cases by uncovering facts, establishing
timelines, and identifying relevant evidence for prosecution or resolution.
Analysis Phase:
1. Data Examination and Exploration:
Forensic analysts begin by examining the collected digital evidence in detail,
exploring its contents, structure, and context. This involves:
- Reviewing files, documents, logs, databases, and other digital artifacts for
relevant information.
- Examining metadata, timestamps, file attributes, and other contextual data to
understand the relationships and dependencies between different pieces of
evidence.
- Using forensic tools and techniques to search, filter, and sort data based on
specific criteria, such as keywords, file types, or user activities.
2. Data Correlation and Reconstruction:
Analysts correlate and reconstruct events or activities based on the digital
evidence, piecing together timelines, sequences, and relationships between
different actions or entities. This involves:
- Identifying patterns, anomalies, and trends in the data that may be indicative
of suspicious or criminal behavior.

12. - Mapping out sequences of events, actions, or transactions to understand the
chronological flow of activities.
- Correlating digital evidence with other sources of information, such as
witness statements, physical evidence, or external data, to validate findings and
hypotheses.
3. Hypothesis Testing and Validation:
Analysts formulate hypotheses and theories based on the analysis of digital
evidence, testing them against available data and information to validate their
accuracy and reliability. This involves:
- Formulating alternative scenarios or explanations for observed phenomena
or patterns.
- Conducting experiments, simulations, or simulations to test hypotheses and
evaluate their plausibility.
- Gathering additional evidence, conducting interviews, or consulting subject
matter experts to validate findings and conclusions.
4. Contextualization and Interpretation:
Analysts interpret the findings from the analysis in the broader context of the
investigation, considering factors such as motive, intent, and opportunity. This
involves:
- Interpreting digital evidence within the framework of relevant laws,
regulations, and policies governing the investigation.
- Considering the cultural, social, and environmental factors that may have
influenced the observed behaviors or activities.
- Providing context and perspective to help stakeholders understand the
significance and implications of the analysis findings.
5. Documentation and Reporting:

13. Analysts document their analysis findings, observations, and conclusions in a
comprehensive report that communicates the results of the analysis to
stakeholders. This includes:
- Summarizing key findings, patterns, and trends identified during the
analysis.
- Providing detailed explanations, visualizations, and supporting evidence to
substantiate findings and conclusions.
- Adhering to established reporting guidelines, formats, and standards to
ensure the report's accuracy, completeness, and credibility.
Importance of Analysis:
- Insight Generation: Analysis uncovers valuable insights, patterns, and trends
hidden within digital evidence, providing critical information to support
investigative objectives and decision-making.
- Event Reconstruction: By correlating and reconstructing events or activities,
analysis helps investigators understand the sequence of actions, motivations,
and consequences related to the incident under investigation.
- Evidence Evaluation: Analysis helps evaluate the relevance, reliability, and
credibility of digital evidence, enabling investigators to assess its probative
value and admissibility in legal proceedings.
- Case Resolution: Through rigorous analysis, forensic analysts contribute to the
resolution of cases by uncovering facts, identifying relevant evidence, and
supporting investigative theories, conclusions, and legal proceedings.
Presentation Phase:
1. Data Synthesis and Summarization:
Forensic analysts synthesize and summarize the key findings, insights, and
conclusions derived from the analysis of digital evidence. This involves:
- Consolidating and organizing analysis results into a coherent and structured
format, such as a report, presentation, or briefing document.

14. - Identifying and highlighting the most relevant and impactful findings that
support investigative objectives and decision-making.
2. Visualization and Representation:
Analysts use visual aids, charts, graphs, diagrams, and other forms of
visualization to represent analysis findings and trends effectively. This includes:
- Creating visualizations that illustrate patterns, correlations, timelines, and
relationships identified during the analysis.
- Using graphical representations to convey complex information in a clear
and intuitive manner, enhancing comprehension and retention.
3. Narrative Development:
Analysts develop a narrative or storyline that contextualizes the analysis
findings within the broader context of the investigation. This involves:
- Crafting a compelling narrative that explains the sequence of events,
motivations, and consequences related to the incident under investigation.
- Providing background information, contextual details, and relevant facts to
help stakeholders understand the significance and implications of the analysis
findings.
4. Presentation Delivery:
Forensic analysts deliver presentations or briefings to stakeholders, conveying
the analysis findings, conclusions, and recommendations effectively. This
includes:
- Tailoring the presentation format, content, and style to the preferences and
needs of the target audience, such as technical experts, legal professionals, or
executive decision-makers.
- Using appropriate communication techniques, such as storytelling,
persuasion, and engagement, to capture the audience's attention and convey
complex information effectively.

15. - Allowing opportunities for questions, discussions, and feedback to clarify
understanding, address concerns, and solicit input from stakeholders.
5. Documentation and Reporting:
Analysts document and report the presentation outcomes, including any
feedback, decisions, or actions resulting from the presentation. This involves:
- Documenting key discussion points, decisions, and action items arising from
the presentation for future reference and follow-up.
- Incorporating presentation materials, including slides, handouts, and
supporting documents, into formal reports or documentation to maintain a
record of the presentation process and outcomes.
Importance of Presentation:
-Decision Support: Effective presentation of analysis findings helps
stakeholders make informed decisions, formulate strategies, and allocate
resources based on the insights derived from digital evidence.
- Stakeholder Engagement: Presentation facilitates engagement and
collaboration among stakeholders by providing a platform for sharing
information, soliciting input, and fostering dialogue.
- Communication of Complex Information: Presentation distills complex
analysis findings into accessible, understandable, and actionable insights,
enabling stakeholders to grasp the significance and implications of the analysis.
- Influence and Persuasion: Well-executed presentation techniques can
influence stakeholders' perceptions, attitudes, and behaviors, driving alignment,
commitment, and action in response to the analysis findings.
Methodology:
Preliminary Assessment: The digital forensics team conducts an initial
assessment to understand the scope and nature of the suspected fraud, identify
key stakeholders, and define investigative objectives.

16. Evidence Acquisition: Relevant digital evidence, including transaction logs,
email communications, financial statements, and user activity logs, is acquired
using forensically sound methods to ensure its admissibility in court.
Data Analysis: Forensic analysts examine the acquired evidence using
specialized tools and techniques to identify patterns, anomalies, and potential
indicators of fraudulent activity.
Reconstruction of Events: Investigators reconstruct the sequence of events
leading to the fraudulent transactions, tracing the flow of funds, identifying
involved parties, and establishing motives.
Chain of Custody Management: Strict protocols are followed to maintain the
integrity of digital evidence throughout the investigation, documenting its chain
of custody to validate its authenticity.
Reporting: Findings, analysis, and conclusions are documented in a
comprehensive forensic report, detailing the methods employed, evidence
discovered, and recommendations for further action.
Collaboration with Legal Authorities: Forensic experts collaborate with law
enforcement agencies and legal counsel to ensure that the collected evidence
meets the requirements of admissibility in court and support prosecution efforts.
Challenges:
Data Volume and Complexity: The sheer volume and complexity of financial
data pose challenges to effective analysis, requiring advanced analytical tools
and expertise.
Legal and Regulatory Compliance: Investigators must adhere to legal and
regulatory frameworks governing data privacy, evidence handling, and
investigative procedures to maintain integrity and admissibility of evidence.
Cross-border Jurisdictional Issues: Cross-border transactions and international
involvement in financial crimes may complicate the investigation due to
jurisdictional differences and legal complexities.
Insider Threats: Insider collusion and complicity present unique challenges,
requiring careful scrutiny of internal systems, access controls, and employee
behavior.
Outcomes: Through meticulous digital forensic analysis, the investigative team
successfully identified the individuals responsible for orchestrating the

17. fraudulent activities within the bank. The evidence gathered facilitated legal
action against the perpetrators, leading to their prosecution and recovery of
misappropriated funds. Additionally, the investigation revealed vulnerabilities
in the bank's internal controls and security mechanisms, prompting the
implementation of enhanced fraud detection and prevention measures.
WHAT TOOLS ARE USED FOR DIGITAL FORENSICS?
At the early stages of digital forensics development, the specialists had a very
limited choice of tools used to analyze digital evidence. It led to multiple
allegations that such analysis might have caused evidence to be altered and
corrupted. Inevitably, there emerged sophisticated tools designed specifically
for digital forensics analysis.
 Disk and data capture tools can detect encrypted data and capture and preview
the information on physical drives;
 File viewers and file analysis tools work to extract and analyze separate files;
 Registry analysis tools get the information about a user and their activities from
the Windows registry;
 Internet and network analysis tools provide detailed information about traffic
and monitor user’s activity on the Internet;
 Email analysis tools are designed to scan email content;
 Mobile device analysis tools help extract data from the internal and external
memory of mobile devices;
 Mac OS analysis tools retrieve metadata from Mac operating systems and
provide disk imaging;
 Database forensics tools can analyze and manipulate data and provide reports of
activities performed.
TYPES OF DIGITAL EVIDENCES
Digital evidence is any sort of data stored and collected from any electronic
storage device. Digital evidence can also be retrieved from wireless networks
and random-access memory. There are many types of electronic evidence and
methodologies of their retrieval, storage, and analysis. The types of electronic
evidence include but are not limited to the following examples:

18.  Media files (photo, video, audio);
 User account data (usernames, passwords, avatars);
 Emails (content, senders’ and receivers’ information, attachments);
 Web browser history;
 Phone calls (video, audio);
 Databases;
 Accounting program files;
 Windows registry system files;
 RAM system files;
 Any type of digital files (text files, spreadsheets, PDF files, bookmarks, etc.);
 Records from networking devices;
 ATM transaction logs;
 GPS logs;
 Electronic door logs;
 CCTV cameras records;
 Hidden and encrypted data;
 Printer, fax, and copy machine logs;
 Computer backups.
DIFFERENT TYPES AND BRANCHES OF DIGITAL FORENSICS?
Digital forensics is a fast-growing scientific discipline. It evolves in response to
the tremendous development of technology. At the current stage, digital
forensics has its branches specializing in narrow fields.
COMPUTER FORENSICS
Computer forensics provides the collection, identification, preservation, and
analysis of data from personal computers, laptops, and storage computing
devices.
Specialists in computer forensics are mostly involved in investigations of
computer crimes, but their services are often needed in civil cases and the
process of data recovery.

19. MOBILE DEVICE FORENSICS
Specialists in this branch can retrieve data from smartphones, SIM cards,
mobile phones, GPS devices, tablets, PDAs, and game consoles.
This type of analysis is required to retrieve audio and visual data, contacts, and
call logs from the devices presented in court as evidence.
NETWORK FORENSICS
Network forensics aims to monitor, register, and analyze any network activity.
The network specialists analyze traffic and activity in case of security breaches,
cyberattacks, and other incidents in cyberspace.
FORENSIC DATAANALYSIS
This branch of forensics analyzes structured data.
The data analysts are mainly involved in investigating financial crimes and
fraud.
DATABASE FORENSICS
Database forensic specialists investigate any access to a database and report any
changes made in the data.
Database forensics can be used to verify commercial contracts and to investigate
large-scale financial crimes.

20. EMAIL FORENSICS
Email forensics analysts retrieve relevant data from email. This information can
be the senders’ and receivers’ identities, the content of the messages, time
stamps, sources, and metadata.
Email forensics tools are widely used when a company is suspected of email
forgery.
MALWARE FORENSICS
The specialists in this branch detect, analyze, and investigate different malware
types to trace suspects and reasons for the attack. They also evaluate the damage
caused by the attack and determine the code of the malware.
MEMORY FORENSICS
This type of digital forensics is also called live acquisition. It retrieves the data
from RAM. The recent development in cybercrime technology enables hackers
to leave no traces on hard drives. In such cases, memory forensics helps to track
down the attack.
WIRELESS FORENSICS
Wireless forensics uses specific tools and methodologies to analyze and
investigate traffic in a wireless environment.
This type of analysis is crucial when computer crimes or cyberattacks are
committed through the breach of security protocols in wireless networks.

21. DISK FORENSICS
Specialists in disk forensics retrieve and recover data from hard drives and other
physical storage devices, such as memory cards, servers, flash drives, and
external USB sticks.
Disk forensics analysts make sure any data relevant to the case is recovered,
analyzed, and presented as evidence.