Digital Systems and Evidence Sources

Introduction

Digital evidence is information of potential investigative or legal value that is created, processed, stored, transmitted, or deleted by digital systems. It may consist of an email, a document, a browser record, a system event, a network connection, a location record, or a fragment of deleted data. Unlike many physical objects, digital evidence is highly dependent on technology, configuration, time, and method of acquisition. A single action—such as opening a file—may update access times, create temporary files, generate log entries, and transmit network data.

Digital evidence therefore cannot be understood merely as “data found on a computer.” It must be interpreted in relation to the system that produced it, the user or process that interacted with it, and the procedures used to collect and preserve it. Cyber-forensics practitioners must understand both the technical origin of evidence and the legal importance of integrity, authenticity, reliability, and continuity of possession.

This chapter introduces the principal sources of digital evidence: computers, operating systems, file systems, storage media, metadata, logs, networks, mobile and cloud-connected devices. It also explains how evidence is created, altered, hidden, and deleted, and establishes a foundation for later forensic acquisition and analysis.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain how digital systems create and store potentially relevant evidence.
2. Distinguish physical storage, logical data, metadata, and system artefacts.
3. Describe the evidential significance of operating systems and file systems.
4. Identify common evidence sources in computers, networks, mobile devices, and cloud environments.
5. Explain how files and records may be modified, deleted, concealed, or recovered.
6. Discuss the importance of timestamps, logs, hashes, provenance, and chain of custody.
7. Recognise important technical, ethical, legal, and practical limitations in digital forensics.

1. Digital Systems as Evidence-Producing Environments

A digital system is an arrangement of hardware, software, data, communication interfaces, and users or automated processes. Evidence may arise from intentional human actions or from routine system operation. For example, a user may intentionally send a threatening message, while the operating system automatically records a login event and the network automatically records a connection attempt.

Evidence sources can be classified in several ways:

The same artefact can have more than one role. A browser history entry may reveal content accessed, while its timestamp and profile association provide contextual information. Evidence should therefore be examined as part of an interconnected system rather than as isolated files.

Figure: Major digital evidence sources contribute to a contextual forensic interpretation.

2. Computers and Hardware Evidence

A computer includes central processing units, memory, storage, input and output devices, firmware, and communication interfaces. Each component may hold evidence.

2.1 Volatile memory

Random access memory (RAM) contains active processes, encryption keys, clipboard contents, fragments of communications, injected code, and open network connections. RAM is volatile: its contents may change continuously and may be lost when a device is powered off. A live response can therefore preserve evidence unavailable from a later examination of the storage drive. However, collecting RAM changes the system to some extent, so the examiner must document tools, commands, time, and observed effects.

2.2 Persistent storage

Hard disk drives, solid-state drives, removable media, optical media, and network-attached storage retain data after shutdown. Persistent storage may contain allocated files, unallocated space, file-system metadata, deleted entries, recovery partitions, hibernation files, and backups.

Hard disk drives generally store data magnetically on platters. Solid-state drives use flash memory and controllers that may relocate, consolidate, or erase data internally. Features such as wear levelling and the TRIM command can make recovery of deleted data from solid-state storage uncertain. This does not mean that deletion is always complete; it means that conclusions must be based on the device, operating system, controller behaviour, and examination results.

2.3 Firmware and peripheral devices

Firmware can preserve configuration, boot information, or malicious persistence mechanisms. Printers, scanners, routers, cameras, keyboards, and external drives may contain logs, cached documents, connection records, or identifiers. A peripheral should not be dismissed simply because it is not the primary computer.

3. Operating Systems as Evidence Sources

An operating system manages hardware, files, users, processes, security controls, and communications. It is also a major evidence-producing environment.

Important operating-system artefacts include:

• user accounts, security identifiers, and privilege assignments;
• login, logout, lock, and authentication records;
• process execution and service-start information;
• scheduled tasks and startup programs;
• installed applications and update histories;
• system configuration and registry-like databases;
• virtual memory, hibernation, and crash-dump files;
• shell history, recent-item lists, and shortcut files;
• print records, connected-device records, and mount histories;
• security, firewall, and antivirus events.

An operating-system record does not automatically prove that a particular person performed an action. An account may be shared, a device may be unattended, credentials may be stolen, and automated software may generate activity. Attribution requires correlation with other evidence, including authentication data, physical access, network records, user behaviour, and device location.

Operating systems also have different notions of time. A system may store local time, Coordinated Universal Time (UTC), or a time value that is later displayed after conversion. Time-zone settings, daylight-saving changes, clock drift, virtual machines, and inaccurate system clocks can produce apparent inconsistencies. A forensic timeline must record the source time, time zone, conversion method, and confidence level.

4. File Systems and Storage Structures

A file system is the method by which an operating system names, organises, locates, protects, and retrieves data on storage media. Examples include NTFS, exFAT, FAT variants, APFS, HFS+, ext4, and file systems used by mobile devices and embedded systems.

4.1 Files, directories, and allocation

A file normally has content and descriptive information. Directories or folders provide organisational structure. The file system records where data blocks or allocation units are located, which may be contiguous or fragmented. A file may be logically present even when its content is distributed across many physical locations.

File systems commonly maintain records for:

• file name and path;
• size and allocation status;
• creation, modification, access, and metadata-change times;
• owner, group, and permissions;
• file attributes such as hidden or system status;
• links, identifiers, and directory relationships.

The precise meaning of a timestamp varies by file system. “Created” may refer to creation on that volume rather than original authorship. “Modified” may reflect a change to content, while “accessed” may be disabled, delayed, or updated by system policy. Timestamps are useful, but they are not self-proving statements about human conduct.

4.2 Deleted and concealed data

Deletion usually removes or marks a reference to a file rather than immediately overwriting every underlying data block. The operating system may mark the space as available for reuse. Until overwritten, remnants may be recoverable through file-system records, unallocated-space analysis, application databases, backups, or file signatures.

Common concealment techniques include:

• changing file extensions;
• setting hidden or system attributes;
• storing data in alternate streams or unusual directories;
• embedding information in images or other media;
• encrypting archives or volumes;
• deleting logs or manipulating timestamps;
• using temporary, virtual, or cloud-synchronised locations.

Recovery is not guaranteed. Overwriting, encryption without available keys, secure erasure, damaged media, compression, and proprietary formats can limit or prevent interpretation.

4.3 File signatures and logical interpretation

A file extension is only a label. A forensic examiner may compare the extension with the file header or signature, examine internal structure, and use validated tools to determine whether a file is genuine, damaged, renamed, or deliberately disguised. Interpretation must avoid treating a successful parser result as conclusive proof of authorship or intent.

5. Metadata and Provenance

Metadata is data about data. It may be embedded within a file, stored by the file system, or maintained by an application or service. Examples include author fields in a document, camera model and geolocation in a photograph, editing history, document revision information, message headers, and media creation dates.

Metadata can answer questions such as:

• When was an item created, modified, exported, or transmitted?
• Which application or device produced it?
• Which account or organisation is associated with it?
• Was it copied, converted, synchronised, or edited?
• What technical settings or location information were recorded?

Metadata is not necessarily reliable. It can be altered by ordinary software, changed during copying, stripped by privacy tools, or fabricated. A photograph’s embedded location may indicate the device setting, not the actual place where the photograph was taken. Metadata should therefore be compared with independent sources such as network records, physical access records, application logs, and witness evidence.

Provenance describes the history and origin of an item. A strong provenance record identifies the source device or account, acquisition method, date and time, examiner, tools used, transformations performed, and storage locations. Provenance is central to demonstrating that an exhibit is what it is claimed to be.

6. Logs, Auditing, and Timelines

A log is a chronological record generated by a system, application, device, or service. Logs may record authentication, process execution, firewall activity, DNS requests, web requests, database operations, file access, security alerts, and administrative changes.

Log quality depends on configuration. Important questions include:

1. Was logging enabled at the relevant time?
2. What events were recorded, and what events were excluded?
3. Was the log protected from alteration?
4. What clock and time zone were used?
5. Could an administrator, attacker, or automated process modify it?
6. How long was it retained?
7. Can the event be linked to a user, device, or process?

Centralised logging can improve resilience because a compromised endpoint may not be able to alter a remote copy. Nevertheless, collection systems, network delays, clock differences, and parsing errors can introduce apparent discrepancies.

A forensic timeline combines events from multiple sources. It should preserve the original timestamp and document normalisation. The examiner should distinguish between an event directly recorded by a system and an inference drawn from several events. For example, a successful login record supports access to an account, but it may not establish who controlled the keyboard.

7. Applications and User Activity

Applications create extensive evidence beyond their visible documents. Web browsers may store history, downloads, cookies, cached objects, saved form data, session tokens, bookmarks, and autofill records. Email applications may store messages, headers, attachments, local indexes, deleted-item folders, and synchronisation databases. Collaboration platforms may retain messages, edits, reactions, file shares, and access events.

Databases are especially important. Many applications store records in SQLite or proprietary databases. Deleted records may remain in database free pages or journal files, while indexes may preserve references after content changes. Correct interpretation requires understanding the application version, database schema, time representation, synchronisation behaviour, and possible corruption.

User activity must be interpreted carefully. A cached webpage does not necessarily prove that a person intentionally read it. A download may have been automatic. A message shown in an application may have originated on another device and synchronised later. The examiner should identify whether the evidence reflects creation, receipt, viewing, editing, synchronisation, or merely storage.

8. Networks and Networked Devices

Network evidence is distributed across endpoints and infrastructure. Sources include routers, switches, wireless access points, firewalls, intrusion-detection systems, domain-name services, virtual private networks, proxies, servers, and cloud platforms.

Network evidence may reveal:

• source and destination addresses;
• ports and protocols;
• connection times and duration;
• authentication attempts;
• DNS lookups;
• data volumes;
• device identifiers and wireless associations;
• malware communications;
• administrative actions.

An IP address generally identifies a network interface or allocation, not necessarily a person. Network address translation, shared wireless access, virtual private networks, proxies, compromised devices, and dynamic addressing complicate attribution. Address records should be correlated with authentication, subscriber, endpoint, and physical-access information.

Packet captures may contain payloads, protocol metadata, or only selected traffic. Encryption may prevent content inspection while leaving timing, endpoints, and volume visible. Network monitoring must also consider privacy, lawful authority, retention, and the risk that capturing sensitive communications exceeds the investigative purpose.

9. Mobile, Internet of Things, and Cloud Evidence

Mobile devices combine local storage, sensors, communications, applications, and cloud synchronisation. Evidence may include call records, messages, contacts, photographs, location data, Wi-Fi history, health information, application databases, notifications, and device backups. Encryption, secure enclaves, locked devices, rapidly changing applications, and remote wiping can make acquisition difficult.

Internet-of-things devices—such as smart speakers, cameras, watches, vehicles, and access-control systems—may create event histories and sensor data. Their clocks, retention periods, proprietary formats, and dependence on vendor services require careful validation.

Cloud evidence is usually held by a service provider rather than solely on a local device. Relevant sources may include provider audit logs, account activity, synchronisation records, version histories, access tokens, backups, and legal-preservation records. A local synchronised file may not represent the complete cloud history. Conversely, cloud records may reflect automated synchronisation rather than deliberate user action.

Jurisdiction is a major issue. Data may be distributed across countries, and access may require statutory authority, a warrant, consent, contractual procedures, or international cooperation. Investigators must understand the applicable law before obtaining or disclosing content.

10. Integrity, Authenticity, and Chain of Custody

Integrity concerns whether evidence has remained unchanged or whether changes are known and documented. A cryptographic hash produces a value derived from data. If the same algorithm and input are used, identical data should produce the same hash; a change in the input should normally produce a different value. Hashes support integrity checking, but they do not prove who created a file, whether the original file was truthful, or that the acquisition process captured all relevant data.

Examiners commonly work from a forensic image or verified logical export while preserving the original source. Write blockers, read-only methods, controlled storage, access logs, and repeatable procedures reduce the risk of alteration. Every action should be documented sufficiently for another competent examiner to understand and reproduce the process.

Chain of custody records the chronological possession, handling, transfer, storage, and examination of evidence. A useful record identifies the exhibit, person or organisation responsible, date and time, purpose of transfer, condition, and storage location. A missing entry does not automatically make evidence meaningless, but it can weaken confidence and create challenges concerning authenticity and alteration.

11. How Digital Evidence Is Altered or Destroyed

Evidence may change through ordinary use, malicious action, system maintenance, synchronisation, software updates, clock correction, log rotation, encryption, deletion, overwriting, or hardware failure. Even examination can alter a live system. The risk is greatest with volatile data and systems that continue operating during seizure.

Important sources of alteration include:

• opening files or applications;
• connecting a device to a network;
• allowing cloud synchronisation;
• booting from the device under examination;
• installing acquisition software;
• changing passwords or unlocking accounts;
• powering off systems that contain volatile evidence;
• allowing automated cleanup or log rotation.

There is no universal rule that a device should always be unplugged or always left running. The decision depends on encryption, active threats, volatile evidence, organisational policy, legal authority, safety, and the risk of remote destruction. A trained practitioner should make and document the decision using an approved procedure.

12. Applied Case: The Disappearing Project Files

Background

The following is an illustrative case. A small organisation reports that confidential project files were copied shortly before an employee resigned. The files no longer appear in the employee’s working folder, and management suspects deliberate deletion.

Problem

The organisation must determine whether files were accessed and copied, identify relevant times and accounts, and preserve evidence without altering the workstation or violating the privacy of unrelated employees.

Analysis

An initial review identifies several possible sources: the workstation’s file-system records, recent-item artefacts, USB connection history, browser and cloud-synchronisation records, authentication logs, endpoint-security alerts, and the organisation’s file server. Investigators note that the workstation clock is four minutes slow and that the employee’s account was sometimes used by an assistant.

A live examination is considered because the device may contain an active encrypted volume and volatile synchronisation information. The team documents the screen state, network condition, logged-in account, and running processes before following an approved collection procedure. A forensic image is acquired using a write-controlled method, and integrity values are recorded before analysis.

The analysis shows that the project files were modified at 16:12, copied to a removable drive at 16:15, and deleted from the working folder at 16:18. However, the USB identifier belongs to a device also used by the assistant. A file-server log records access by the employee’s account, but authentication records show that the account was active on two workstations. Cloud records show synchronisation at 16:21, but do not establish who initiated it.

Outcome

The evidence supports a conclusion that the files were accessed, copied, and later deleted from the workstation. It does not, by itself, prove that the departing employee personally performed every action. Attribution requires additional evidence, such as physical-access records, camera footage, interviews, device possession, or independently preserved communications.

Learning Points

1. Deleted files may leave recoverable traces.
2. A timestamp must be interpreted with clock and time-zone information.
3. Account activity is not identical to human identity.
4. USB, server, endpoint, and cloud records are more informative when correlated.
5. A forensic conclusion should state both what the evidence supports and what it cannot establish.

13. Professional, Ethical, and Regulatory Considerations

Digital forensic work must be lawful, proportionate, technically competent, and respectful of privacy. Investigators should collect only what is authorised and reasonably relevant, protect confidential or privileged material, and restrict access to authorised personnel. Personal devices and cloud accounts may contain health, family, financial, or legally privileged information unrelated to an investigation.

The governing legal framework varies by jurisdiction, but common concerns include search and seizure authority, consent, privacy and data-protection law, workplace monitoring rules, interception restrictions, disclosure obligations, and rules governing expert evidence. Technical capability does not create legal authority. A practitioner should obtain appropriate instructions and consult applicable law before acquisition.

Ethical practice also requires impartiality. Examiners should not selectively report only incriminating artefacts, should preserve exculpatory material, should disclose limitations, and should avoid overstating conclusions. Tools must be validated for their intended purpose, and proprietary outputs should be independently reviewed where feasible.

14. Contemporary Developments and Best Practices

Encryption, zero-trust architectures, containerisation, remote work, privacy-enhancing technologies, artificial-intelligence systems, and ephemeral messaging are changing evidence environments. AI-generated or AI-assisted content introduces questions about provenance, model logs, prompt records, account ownership, and the possibility of fabricated media. Detection tools may assist triage, but their outputs are probabilistic and require validation; they should not be treated as conclusive proof of origin or intent.

Recommended foundational practices are:

• plan collection before touching evidence;
• document system condition, time, authority, and personnel;
• prioritise volatile evidence when justified;
• use validated tools and write-controlled methods;
• preserve originals and analyse verified working copies;
• record hashes, transfers, tool versions, and transformations;
• normalise time carefully and retain original timestamps;
• correlate independent sources rather than relying on one artefact;
• minimise unnecessary personal-data exposure;
• report uncertainty, alternative explanations, and limitations;
• maintain secure storage, access control, and retention procedures.

Chapter Summary

Digital systems continuously create evidence through user actions, operating-system functions, applications, networks, storage devices, and cloud services. Evidence may be volatile or persistent, user-created or system-generated, substantive or contextual. Computers provide evidence through RAM, drives, firmware, peripherals, and connected media. Operating systems and file systems preserve information about users, processes, files, permissions, timestamps, and deletion. Metadata and logs help establish provenance and sequence, but they can be incomplete, altered, or misleading when viewed in isolation.

Deleted data may remain in unallocated space, databases, caches, backups, or synchronised services, although recovery is affected by encryption, overwriting, solid-state storage behaviour, and proprietary systems. Network, mobile, IoT, and cloud environments broaden the evidence landscape while increasing problems of attribution, jurisdiction, privacy, and retention. Integrity is supported by validated acquisition, hashing, secure handling, documentation, and chain of custody. Sound forensic interpretation correlates multiple sources, distinguishes recorded facts from inferences, and states limitations clearly.

Key Terms

Digital evidence: Information of potential investigative or legal value in digital form.

Volatile evidence: Data that may disappear when a system is powered off or changed.

Persistent storage: Storage that retains data after power is removed.

Operating system artefact: A record created or maintained by an operating system.

File system: A structure and set of procedures for organising and managing stored data.

Metadata: Data describing the characteristics, origin, history, or use of other data.

Provenance: The documented origin and history of an item or record.

Timestamp: A recorded date and time associated with an event or object.

Log: A chronological record generated by a system, application, or service.

Unallocated space: Storage space not currently assigned to an active file.

File carving: Recovering data from storage using content patterns rather than directory records.

Hash: A value calculated from data and used mainly to check integrity.

Forensic image: A sector-level or otherwise controlled copy of digital storage for examination.

Write blocker: A hardware or software control designed to prevent writing to an evidence source.

Chain of custody: The documented history of evidence possession and handling.

Attribution: The process of linking an action or artefact to a person, account, device, or process.

Cloud evidence: Data or records held in remote provider infrastructure.

Network address translation: A technique that allows multiple devices to share or map network addresses.

Live response: Collection performed while a system is running.

Volatile memory: Memory whose contents depend on continuing power or operation.

Review Questions

Short Answer Questions

1. What is the difference between volatile and non-volatile digital evidence?
2. Why is a file extension not reliable proof of a file’s true type?
3. What information can metadata provide?
4. Why does an IP address not necessarily identify a particular person?
5. What is the purpose of a write blocker?

Long Answer Questions

1. Explain how an operating system creates evidence through account management, process execution, file handling, and security logging.
2. Discuss how deletion, concealment, encryption, and solid-state storage behaviour affect the recovery of digital evidence.
3. Explain the importance of timestamps and describe factors that may make them unreliable or difficult to interpret.
4. Compare endpoint, network, mobile, IoT, and cloud evidence sources.
5. Describe how integrity, provenance, and chain of custody contribute to the admissibility and credibility of digital evidence.

Analytical / Application Questions

1. A company discovers that confidential files were deleted after being copied to a USB device. Design an evidence-collection plan that addresses volatile evidence, file-system artefacts, USB history, server logs, and cloud synchronisation.
2. A login log records successful access from an employee’s account, but the employee denies performing the action. What additional evidence would you seek, and what alternative explanations must be considered?
3. A forensic timeline shows events occurring in an apparently impossible order. Analyse at least five technical reasons for the inconsistency and explain how you would test each explanation.

Multiple Choice Questions with Answers

Question 1

Which item is most likely to be volatile evidence?

A. A document stored on a powered-off hard drive

B. A running process held in RAM

C. A printed contract

D. A archived email backup

Correct Answer: B. A running process held in RAM

Question 2

What does a file system primarily manage?

A. The legal admissibility of evidence

B. The physical security of a building

C. The organisation and retrieval of data on storage media

D. The identity of every person using a device

Correct Answer: C. The organisation and retrieval of data on storage media

Question 3

Why should a timestamp not be treated as conclusive proof of human action?

A. Timestamps are always random

B. Automated processes and clock settings can create or alter recorded times

C. File systems cannot store dates

D. Only network devices use timestamps

Correct Answer: B. Automated processes and clock settings can create or alter recorded times

Question 4

What is the principal purpose of a cryptographic hash in forensic work?

A. To identify the person who created a file

B. To decrypt a protected volume

C. To support checking whether data has changed

D. To recover every deleted file

Correct Answer: C. To support checking whether data has changed

Question 5

Which statement about an IP address is most accurate?

A. It always identifies a specific individual

B. It identifies a network interface or allocation and requires context for attribution

C. It proves that encrypted content was read

D. It is stored only on mobile devices

Correct Answer: B. It identifies a network interface or allocation and requires context for attribution

Question 6

Which action can change evidence on a live computer?

A. Observing the device from a distance without connecting to it

B. Opening an application or file during examination

C. Writing the exhibit number on its packaging

D. Recording the device serial number from its label

Correct Answer: B. Opening an application or file during examination

Question 7

What is chain of custody?

A. A method for compressing forensic images

B. The documented history of evidence possession and handling

C. A process for assigning IP addresses

D. A file-system allocation method

Correct Answer: B. The documented history of evidence possession and handling

Question 8

Why can cloud evidence differ from a locally synchronised file?

A. Cloud services cannot retain historical information

B. Local files always contain more information than cloud records

C. Cloud systems may hold versions, audit records, and synchronisation events not present locally

D. Cloud data is never associated with an account

Correct Answer: C. Cloud systems may hold versions, audit records, and synchronisation events not present locally

Question 9

Which conclusion is best supported when a file is found in unallocated space?

A. A person definitely opened the file

B. The file or its remnants were previously associated with storage space

C. The file was created after the investigation began

D. The file was transmitted over the internet

Correct Answer: B. The file or its remnants were previously associated with storage space

Question 10

Why should forensic examiners correlate several evidence sources?

A. A single artefact may be incomplete or open to alternative explanations

B. Corroboration makes documentation unnecessary

C. Multiple sources eliminate all uncertainty

D. Legal authority is unnecessary when sources agree

Correct Answer: A. A single artefact may be incomplete or open to alternative explanations