Foundations of Digital Forensics

Introduction and Context

Digital technology has transformed how people communicate, conduct business, store information, and exercise public authority. It has also transformed the nature of evidence. A relevant fact may now be represented by a database record, cloud log, mobile-device artifact, deleted file, network flow, cryptographic key, or sensor reading. Such evidence is often distributed across devices and jurisdictions, rapidly altered by routine system activity, and dependent on proprietary software for interpretation.

Digital forensics is the disciplined process of identifying, preserving, acquiring, examining, analyzing, interpreting, and reporting information from digital systems for use in investigations, legal proceedings, regulatory inquiries, incident response, and organizational decision-making. It is both a technical and evidential discipline. Technical skill is necessary to recover and interpret data, but it is not sufficient: the investigator must also demonstrate that the evidence is authentic, reliably acquired, properly documented, and relevant to the question being investigated.

This chapter establishes the conceptual foundation for postgraduate study. It explains the historical development, scope, branches, terminology, forensic workflow, relationship with cybersecurity, evidential reasoning, governance requirements, and contemporary challenges of digital forensics.

Learning Objectives

After studying this chapter, a student should be able to:

1. Explain the purpose, history, scope, and major branches of digital forensics.

2. Distinguish forensic examination from cybersecurity operations and incident response.

3. Define and apply the terms artifact, trace, metadata, provenance, integrity, attribution, and evidential value.

4. Describe a defensible forensic workflow and the roles of documentation, validation, and quality assurance.

5. Evaluate limitations involving attribution, cloud environments, encryption, privacy, automation, and legal authority.

6. Apply foundational concepts to an investigative scenario and communicate conclusions with appropriate caution.

1. Meaning and Purpose of Digital Forensics

Digital forensics may be defined as the application of scientifically informed methods to the identification, preservation, acquisition, examination, analysis, interpretation, and presentation of information from digital sources. The term “digital” includes computers, mobile phones, removable media, networks, cloud services, industrial systems, vehicles, Internet-of-Things devices, applications, and embedded systems.

The purpose of an examination is not simply to find suspicious files. It is to answer a defined question, such as:

• Was a confidential document accessed or copied?
• Which account performed a particular action?
• When did a compromise begin, and what systems were affected?
• Was a message created, transmitted, or received by a particular device?
• Can a recovered item be shown to be unchanged since acquisition?

A forensic conclusion should therefore connect data to a proposition. For example, “the browser history contains a visit to a website” is a data observation. “The employee intentionally downloaded restricted material” is a stronger proposition requiring additional evidence concerning identity, intent, authorization, and context.

Digital forensics serves several settings:

• Criminal investigations and prosecution
• Civil litigation and employment disputes
• Corporate investigations and fraud examinations
• Cybersecurity incident response
• Regulatory and compliance inquiries
• National security and intelligence operations
• Safety investigations and accident reconstruction
• Internal disciplinary proceedings

These settings differ in legal authority, evidential standards, timelines, disclosure obligations, and acceptable investigative methods. A method suitable for rapid incident containment may not be sufficient for court. Conversely, a court-oriented examination may be too slow for an active attack. The forensic practitioner must understand the purpose and constraints of the engagement before collecting data.

2. Historical Development

The roots of digital forensics lie in traditional forensic science, records management, criminal investigation, and computer auditing. During the early era of personal computing, investigators commonly examined individual floppy disks and hard drives manually. As storage capacity increased, specialized tools were developed to recover deleted files, interpret file systems, and create exact copies of media.

The discipline expanded significantly during the 1990s and early 2000s. Law-enforcement agencies established computer crime units, commercial forensic software became available, and courts increasingly encountered electronic records. Investigators began to formalize procedures for write protection, forensic imaging, hash verification, chain of custody, and technical reporting.

Later developments changed the unit of analysis. Investigations moved from isolated computers to enterprise networks, mobile phones, virtual machines, cloud platforms, social-media services, and large-scale log repositories. Volatile evidence, such as running processes and network connections, became important alongside persistent storage. The rise of smartphones introduced location data, application databases, health information, photographs, messaging records, and sensor data.

Contemporary digital forensics is characterized by several developments:

1. Distributed evidence: Relevant data may be spread across an endpoint, identity provider, cloud application, backup service, and network-monitoring platform.

2. High volume: Automated triage and indexing are necessary, but automated results require human validation.

3. Encryption and secure hardware: Full-disk encryption, hardware-backed keys, and end-to-end encrypted applications can restrict access.

4. Short-lived data: Cloud logs, memory contents, and network telemetry may be overwritten quickly.

5. Anti-forensic behavior: Suspects or malware may delete, alter, encrypt, obfuscate, or falsify traces.

6. Privacy and cross-border regulation: Collection may expose information unrelated to the investigation or stored in another jurisdiction.

7. Artificial intelligence: Machine learning can assist with classification and prioritization, but it introduces issues of explainability, bias, reproducibility, and validation.

The field has therefore shifted from “recovering deleted files” toward evidence-centered reconstruction of events across complex socio-technical systems.

3. Scope and Branches of Digital Forensics

Branches are useful for organizing expertise, although real investigations often combine several branches.

3.1 Computer and Storage Forensics

This branch examines desktops, laptops, servers, file systems, removable media, virtual disks, and backup media. Typical evidence includes files, deleted content, file-system structures, operating-system logs, user profiles, registry or configuration data, installed applications, shell history, and system timestamps.

3.2 Mobile-Device Forensics

Mobile forensics concerns smartphones, tablets, SIM or eSIM-related information, application databases, messages, call records, photographs, location information, wireless connections, and device configuration. Investigators must account for device locking, encryption, remote wiping, synchronization, application-specific storage, and frequent operating-system changes.

3.3 Network Forensics

Network forensics examines packet captures, flow records, firewall logs, DNS records, proxy logs, intrusion-detection alerts, VPN records, and authentication events. It is especially useful for reconstructing communication paths, identifying suspicious connections, and establishing the sequence of an intrusion. Network records often show that a connection occurred, but they may not prove who physically operated a device.

3.4 Database Forensics

Database forensics addresses tables, transaction logs, audit trails, stored procedures, deleted records, replication data, and access histories. Investigators must understand database architecture and transaction semantics. A database record may reflect a business process rather than a direct human action, and application-level logs may be more informative than the underlying table alone.

3.5 Cloud and Virtualization Forensics

Cloud evidence may include provider audit logs, identity records, object versions, snapshots, container logs, API calls, virtual-machine images, and configuration histories. The investigator may not control the underlying hardware and may receive evidence through provider interfaces or legal processes. Shared infrastructure, changing retention periods, time-zone differences, and provider-specific formats complicate examination.

3.6 Memory and Live-System Forensics

Volatile data can include running processes, network connections, loaded modules, encryption keys, command history, and injected code. Live acquisition may be necessary when shutting down a system would destroy important evidence. However, interacting with a live system changes it. The investigator must balance evidential preservation against the risk of losing volatile information.

3.7 Malware and Code Forensics

Malware forensics examines malicious programs, scripts, persistence mechanisms, configuration data, command-and-control behavior, and code relationships. Static analysis studies a sample without execution; dynamic analysis observes behavior in a controlled environment. Results must distinguish observed behavior in the test environment from claims about all possible behavior.

3.8 Multimedia, IoT, and Vehicle Forensics

Multimedia forensics examines images, video, audio, and their associated metadata, including possible editing or recompression. IoT and vehicle forensics may involve sensors, firmware, telematics, access systems, and proprietary databases. These sources can be valuable but require careful interpretation because device clocks, synchronization, calibration, and vendor algorithms may be poorly documented.

4. Core Terminology

Artifact

An artifact is a digital object or record that may provide information about an event, user, system, or process. Examples include a browser-history entry, a registry value, a cloud audit record, a thumbnail, or an operating-system event log. An artifact is not automatically proof of a proposition; its meaning depends on origin, reliability, context, and corroboration.

Trace

A trace is a detectable remnant of an action or process. A trace may be persistent, such as a file, or transient, such as a memory-resident process. The terms artifact and trace overlap, but “trace” emphasizes the relationship between an observed remnant and an activity that produced it.

Metadata

Metadata is data about data. File size, creation time, modification time, author field, GPS coordinates, database schema, and email headers are examples. Metadata can be informative but is not necessarily trustworthy. It may be generated automatically, copied during transfer, altered by software, or affected by clock error.

Provenance

Provenance describes the origin, custody, transformations, and handling history of evidence. It answers questions such as where an item came from, who collected it, what tools processed it, and how it moved from source to report. Strong provenance supports reproducibility and credibility.

Integrity

Integrity is the property that evidence has remained complete and unaltered, or that any alteration is identified and controlled. Cryptographic hash values are commonly used to detect changes in acquired data. A matching hash demonstrates that two inputs produce the same digest under the selected algorithm; it does not by itself prove that the original source was authentic, that the acquisition was complete, or that the observed user caused an event.

Attribution

Attribution is the process of associating an action with an account, device, person, organization, or threat actor. Attribution exists on levels. Technical attribution may associate activity with an IP address or device. Account attribution may associate it with credentials. Human attribution requires additional evidence showing who controlled or used the relevant account or device. These levels must not be conflated.

Evidential Value

Evidential value is the contribution an item makes to answering an investigative or legal question. It depends on relevance, reliability, probative strength, independence, and context. A log entry may be highly relevant but weakly reliable if its clock is incorrect or its source can be edited without audit controls.

Volatile and Non-volatile Evidence

Volatile evidence is lost or changed when a system is powered off or continues operating, such as RAM contents and active network sessions. Non-volatile evidence persists on storage, although it can still be modified. The distinction affects collection order and urgency.

Chain of Custody

Chain of custody is the documented history of possession, transfer, storage, access, and handling of evidence. It should identify the item, responsible persons, dates, times, purpose of access, and storage conditions. It is a governance control supporting authenticity and accountability.

5. A Forensic Evidence Model

A useful investigative model separates five questions:

1. Source: Where did the information originate?

2. Event: What activity may have generated it?

3. Time: When did the activity occur, accounting for clock and time-zone issues?

4. Actor: Which account, process, device, or person may be associated with it?

5. Confidence: How strongly does the information support the proposed conclusion?

This model discourages overstatement. For example, a cloud audit record may reliably show that an API token accessed a file at a particular provider time. It may not establish which human used the token, whether the token was stolen, or whether the file contents were read.

Investigators should distinguish observation, inference, and conclusion:

• Observation: A record contains a specified value.
• Inference: The record is consistent with a particular event.
• Conclusion: Considering all evidence and alternatives, a proposition is supported to a stated degree.

The discipline of separating these levels is central to expert reporting.

6. Forensic Examination and Cybersecurity Operations

Digital forensics and cybersecurity operations are closely related but have different primary purposes.

Cybersecurity operations prioritize prevention, detection, containment, eradication, and recovery. Security analysts may block an account, isolate a host, remove malware, reset credentials, or restore services. Speed and risk reduction are usually dominant objectives.

Forensic examination prioritizes preservation, reconstruction, explanation, and defensible presentation. The examiner seeks to minimize unnecessary changes, preserve source material, document methods, validate tools, and maintain an auditable record.

The distinction is not absolute. Incident response contains forensic activities, and forensic findings can improve security controls. However, operational actions can alter evidence. For example, reimaging a compromised computer may restore business operations but destroy memory, persistence mechanisms, and unallocated data. A coordinated response therefore establishes priorities early:

• preserve high-value volatile evidence when feasible;
• record containment actions and their effects;
• acquire forensic copies before destructive remediation where circumstances permit;
• separate original evidence from working copies;
• maintain synchronized and reliable time references;
• define authority, scope, and reporting requirements.

A security alert is also not a forensic conclusion. An alert is a detection generated by a rule, model, or analyst. It may be a lead requiring validation rather than proof of compromise.

7. The Forensic Workflow

Although frameworks vary, a defensible workflow commonly includes the following stages.

7.1 Preparation and Authorization

The team defines the question, scope, authority, systems, time period, personnel, resources, and reporting audience. Legal authorization, consent, organizational policy, and privacy restrictions must be established before collection.

7.2 Identification and Triage

Potential sources are identified and prioritized. Triage considers volatility, relevance, likelihood of loss, business impact, and collection cost. Triage is not a substitute for a complete examination; it is a reasoned method for allocating limited resources.

7.3 Preservation

Evidence is protected from alteration or destruction. Actions may include isolating a device, preserving cloud logs, suspending deletion policies, collecting volatile data, and placing media in controlled storage. The investigator documents what was done and why.

7.4 Acquisition

Acquisition creates a forensic copy or obtains records through an approved export. Where possible, the original is protected from writing. Acquisition notes should identify the source, tool, version, settings, operator, start and end times, errors, and validation results.

7.5 Examination

Examination is the technical processing of evidence: parsing file systems, recovering deleted content, indexing text, decoding application databases, extracting timestamps, or identifying network sessions. Examination should be reproducible and should preserve original data.

7.6 Analysis and Interpretation

Analysis relates observations to hypotheses. Alternative explanations should be considered. An investigator should ask whether a timestamp reflects creation, modification, access, synchronization, or system processing; whether a user could have been impersonated; and whether independent sources corroborate the event.

7.7 Reporting and Presentation

A report states the mandate, scope, methods, evidence examined, findings, limitations, conclusions, and supporting exhibits. Technical language should be explained for the intended audience. Conclusions should be proportionate to the evidence and should distinguish fact from interpretation.

7.8 Review and Quality Assurance

Peer review, tool validation, repeat analysis, checklist controls, and disclosure of errors improve reliability. An examiner should retain sufficient notes and intermediate results for another qualified person to understand and, where possible, reproduce the work.

8. Integrity, Hashing, and Reliability

Cryptographic hashing maps input data to a fixed-length digest. In forensic practice, a digest can be calculated for a source or acquired image before and after handling. If the values match, the tested data has not changed in a way detected by that algorithm. Hashing is therefore an integrity-checking mechanism, not a complete authenticity system.

Integrity also depends on process. A perfectly preserved copy of the wrong device is not useful. Likewise, a matching hash does not correct poor documentation, an incomplete acquisition, an unreliable clock, or an invalid interpretation. Strong evidence normally combines:

• technically appropriate acquisition;
• validated tools and procedures;
• cryptographic verification;
• controlled storage;
• documented custody;
• source and time contextualization;
• independent corroboration where available.

9. Time, Context, and Corroboration

Time is a frequent source of error. Systems may use different time zones, daylight-saving rules, clock settings, synchronization sources, or timestamp semantics. A file’s “modified” time does not necessarily identify the time a person edited it. Analysts should preserve the original representation, record conversion rules, and report uncertainty.

Corroboration increases confidence when independent sources support the same event. For example, a workstation log, identity-provider record, network connection, and cloud audit entry may collectively support a sequence more strongly than any one source. Independence must be assessed carefully: multiple records generated from the same underlying event may not be truly independent.

10. Applied Case: Suspected Unauthorized Disclosure

This is an illustrative fictional case.

Background

A research company detects that a confidential design document was downloaded from its cloud repository and later appears in a competitor’s submission. The relevant employee, Elena, denies downloading or sharing it. The company requests an examination.

Problem

The investigation must determine whether the document was accessed and exported from Elena’s account, whether the account was compromised, and what can responsibly be attributed to Elena herself.

Analysis

The team first defines scope and preserves the cloud provider’s audit logs, identity-provider records, endpoint data, and relevant email. It records the provider’s time zone and retention rules. The cloud log shows a successful download using Elena’s account at 14:08 UTC. The identity provider records a successful multifactor authentication event two minutes earlier from a device previously associated with Elena. Endpoint telemetry shows the workstation process accessing the cloud service, while a network record shows the encrypted session to the provider.

However, the evidence does not immediately establish intentional disclosure. The investigators check whether the account was concurrently used from another location, whether the multifactor device was available to another person, whether malware or token theft occurred, and whether the file was copied to removable media. They also examine access logs for the competitor material without assuming that technical similarity proves source.

Approach and Solution

The team makes a forensic image of the workstation where feasible, preserves volatile information relevant to active sessions, exports cloud logs in provider-native form, calculates hashes for acquired files, and documents each transfer. It compares endpoint timestamps with provider timestamps and identifies a clock offset on the workstation. The report separates findings:

• The cloud account accessed and downloaded the document at the provider-recorded time.
• The access was associated with a recognized device and a valid multifactor event.
• The workstation contained a local copy created shortly after the access.
• No evidence found during the defined examination established that Elena personally operated the workstation at that moment.
• Evidence linking the downloaded file to the competitor’s document was suggestive but not conclusive without additional source and legal evidence.

Outcome

The company suspends the account, preserves additional records, and conducts a broader credential and endpoint investigation. It does not state that Elena committed misconduct solely from the account log. The evidence supports unauthorized or at least unexplained access, while human attribution remains unresolved.

Learning Points

The case illustrates the difference between account attribution and person attribution. It also demonstrates why cloud logs, endpoint artifacts, authentication records, time normalization, and negative findings must be interpreted together. A responsible conclusion can identify what is established, what is probable, and what remains unknown.

11. Challenges, Ethics, and Governance

Digital evidence frequently contains information about people who are not targets of an investigation. Collection should be necessary, proportionate, authorized, and limited to the defined purpose. Investigators must consider privacy, privilege, data minimization, retention, disclosure, and cross-border transfer requirements.

Professional ethics require independence, competence, honesty, confidentiality, and disclosure of limitations. An examiner should not select only evidence supporting a preferred theory. Exculpatory or contradictory material must be recognized and preserved according to applicable obligations.

Major technical limitations include encryption, damaged media, incomplete logs, proprietary formats, anti-forensic techniques, cloud dependency, remote wiping, and inconsistent time sources. Organizational limitations include insufficient logging, unclear authority, poor asset inventories, inadequate retention, and lack of trained personnel.

Automation and AI can improve prioritization, similarity analysis, malware classification, and large-scale review. Nevertheless, AI output is not self-authenticating evidence. Practitioners must understand training data, error rates, model drift, explainability, provenance of generated results, and the possibility of adversarial manipulation. Automated classifications should be treated as investigative aids and validated against source evidence.

12. Contemporary Best Practices

A mature digital-forensics capability should:

1. define authority, purpose, scope, and decision rights before collection;

2. maintain validated tools, documented procedures, and trained personnel;

3. preserve volatile and high-risk evidence early;

4. use write protection or equivalent safeguards where appropriate;

5. calculate and record integrity values for acquired material;

6. maintain complete chain-of-custody and activity records;

7. normalize and document time interpretations;

8. distinguish observations from inferences and conclusions;

9. corroborate important findings using independent sources;

10. state limitations and alternative explanations;

11. protect privacy and restrict access to necessary information;

12. conduct peer review and retain reproducible working notes;

13. periodically test procedures against new operating systems, cloud services, and devices;

14. integrate forensic readiness into security architecture by improving logging, retention, asset inventories, and response plans.

Forensic readiness is particularly important for organizations. It means designing systems and processes so that useful evidence can be collected lawfully, efficiently, and reliably when an incident occurs. This includes synchronized clocks, suitable audit logs, documented retention, identity governance, secure log storage, and tested response procedures.

Chapter Summary

Digital forensics is an evidence-centered discipline that applies systematic methods to digital information for investigation, decision-making, and legal or regulatory use. Its history has moved from isolated computer examinations to distributed, cloud-based, mobile, networked, and increasingly automated investigations.

The field includes computer, mobile, network, database, cloud, memory, malware, multimedia, IoT, and vehicle forensics. Core terms include artifacts, traces, metadata, provenance, integrity, attribution, evidential value, volatility, and chain of custody. These concepts help investigators distinguish raw observations from defensible conclusions.

Cybersecurity operations emphasize rapid risk reduction, whereas forensic examination emphasizes preservation, reconstruction, documentation, and defensibility. They must be coordinated because containment and remediation can alter evidence. A sound workflow includes authorization, identification, preservation, acquisition, examination, analysis, reporting, and quality assurance.

Hash verification supports integrity but does not independently prove authenticity or human responsibility. Attribution must be expressed at the appropriate level, such as device, account, process, or person. Time interpretation, corroboration, privacy, legal authority, cloud architecture, encryption, and AI-assisted analysis are central contemporary concerns. Professional practice requires proportionality, independence, validated methods, transparent limitations, and conclusions that do not exceed the evidence.

Key Terms

Artifact: A digital object or record that may provide investigative information.

Attribution: Association of an action with an account, device, person, organization, or actor.

Chain of custody: Documented history of evidence possession, transfer, storage, and handling.

Cloud forensics: Examination of evidence from cloud services and virtualized environments.

Digital forensics: Systematic identification, preservation, acquisition, examination, analysis, and reporting of digital evidence.

Evidential value: The contribution of information to answering an investigative or legal question.

Examination: Technical processing and extraction of information from evidence.

Forensic readiness: Organizational preparation that enables lawful and efficient evidence collection.

Hash: Fixed-length cryptographic digest used, among other purposes, to check data integrity.

Integrity: Condition in which evidence remains complete and unaltered, or alterations are controlled and known.

Metadata: Data describing other data, such as timestamps, authorship fields, or GPS information.

Network forensics: Examination of network traffic, flow records, and communication logs.

Provenance: Origin, custody, transformation, and handling history of evidence.

Relevance: The degree to which information bears on the investigative question.

Trace: Detectable remnant of an action or process.

Volatile evidence: Information that may disappear or change when a system is powered off or continues operating.

Review Questions

Short Answer Questions

1. Define digital forensics and identify two contexts in which it is used.

2. Distinguish an artifact from an interpretation of an artifact.

3. What is provenance, and why is it important?

4. Explain one major difference between cybersecurity operations and forensic examination.

5. Why does a matching hash not, by itself, prove that a person performed an action?

Long Answer Questions

1. Trace the historical development of digital forensics from personal-computer examinations to cloud and distributed investigations.

2. Explain the major branches of digital forensics and show how at least three may be combined in one investigation.

3. Describe a complete forensic workflow, including authorization, acquisition, analysis, reporting, and quality assurance.

4. Discuss the relationship between metadata, time interpretation, provenance, and evidential value.

5. Critically evaluate the ethical, legal, and technical challenges of using AI in digital-forensics investigations.

Analytical / Application Questions

1. A cloud log records a file download using an employee’s account, while the employee claims the account was compromised. Design an investigation that distinguishes account attribution from person attribution.

2. During an active malware incident, management wants to reimage every affected computer immediately. Analyze the operational and evidential consequences and propose a balanced response plan.

3. An examiner finds matching timestamps in a workstation log and a cloud audit log, but the workstation clock is known to be inaccurate. Explain how the finding should be validated and reported.

Multiple Choice Questions with Answers

Question 1

Which statement best describes digital forensics?

A. The rapid blocking of all suspicious network traffic

B. The systematic handling and interpretation of digital information for investigative purposes

C. The design of encryption algorithms

D. The routine administration of operating systems

Correct Answer: B. The systematic handling and interpretation of digital information for investigative purposes

Question 2

What does provenance primarily describe?

A. The compression ratio of a file

B. The speed of evidence acquisition

C. The origin, custody, transformations, and handling history of evidence

D. The number of users on a network

Correct Answer: C. The origin, custody, transformations, and handling history of evidence

Question 3

Which item is most likely to be volatile evidence?

A. A powered-off hard-drive image

B. A printed incident report

C. A file stored on read-only optical media

D. The contents of active system memory

Correct Answer: D. The contents of active system memory

Question 4

What is the principal purpose of calculating a cryptographic hash for acquired evidence?

A. To detect changes in the tested data

B. To identify the person who created the data

C. To recover every deleted file

D. To convert local time into UTC

Correct Answer: A. To detect changes in the tested data

Question 5

Which conclusion demonstrates appropriate caution?

A. An IP address proves which person typed the command

B. A valid account log always proves intentional user activity

C. The account accessed the file, but the available evidence does not establish who operated it

D. A browser artifact proves that its associated user read the entire website

Correct Answer: C. The account accessed the file, but the available evidence does not establish who operated it

Question 6

What is the primary emphasis of cybersecurity operations compared with forensic examination?

A. Rapid prevention, detection, containment, and recovery

B. Maintaining courtroom exhibits only

C. Recovering deleted files from every device

D. Avoiding all changes to live systems regardless of risk

Correct Answer: A. Rapid prevention, detection, containment, and recovery

Question 7

Which activity belongs primarily to the examination stage?

A. Defining legal authority and scope

B. Parsing a file system and extracting application records

C. Presenting conclusions to a court

D. Deciding whether an organization should notify regulators

Correct Answer: B. Parsing a file system and extracting application records

Question 8

Why must timestamps be interpreted cautiously?

A. All timestamps are automatically encrypted

B. A timestamp always records human intent

C. Systems may use different clocks, time zones, and timestamp semantics

D. Cloud systems cannot produce timestamps

Correct Answer: C. Systems may use different clocks, time zones, and timestamp semantics

Question 9

Which statement about attribution is correct?

A. Technical attribution to a device automatically proves human attribution

B. Attribution can concern a device, account, process, or person, and these levels should be distinguished

C. Attribution is irrelevant when logs are available

D. Attribution is established whenever a file exists on a computer

Correct Answer: B. Attribution can concern a device, account, process, or person, and these levels should be distinguished

Question 10

What is forensic readiness?

A. Deleting logs after an incident to protect privacy

B. Preparing systems and processes so evidence can be collected lawfully and efficiently

C. Allowing analysts unrestricted access to every employee device

D. Replacing all human analysis with artificial intelligence

Correct Answer: B. Preparing systems and processes so evidence can be collected lawfully and efficiently