What Is Digital Forensics? | University of Nevada, Reno

Cybersecurity breaches hit record numbers in 2021, boosting demand for digital forensics professionals. Finding the culprits of ransomware and other attacks isn’t the only use for digital forensics, however. Digital experts use these techniques to solve other crimes, such as break-ins, burglaries, fraud and homicide by identifying, preserving and analyzing digital evidence.

A background in computer technology and advanced courses in cybersecurity can prepare professionals for a rewarding career in an emerging field.

Defining Digital Forensics

Digital forensics is the process by which crime investigators gather digital evidence; protect it from tampering; and extract it from computers, mobile devices and other digital hardware. It requires in-depth knowledge about how devices store digital data and how to preserve this data so it can be analyzed.

What Is Digital Data?

Digital data comes from various sources. Emails, digital images and texts may be the most common. Social media posts can help identify suspects. Browsing histories and cookies, which are bits of code that reveal what websites a user visits, can also be digital evidence. Mobile phone tracking and cellphone tower pings can also be used to identify locations and times. Databases compile large amounts of digital data and metadata (information about data) that can be evidence of crimes.

Where Is Digital Data Stored?

Digital data is stored on hard drives or in the memory drives of computers, tablets, smartphones and other devices. Even when a user deletes files or if a hard drive crashes, digital forensics professionals may be able to recover digital data using methods that include searching hidden folders. They may also be able to retrieve data from temporary files in cache memory.

Additionally, every user has a digital footprint: a kind of bread crumb trail of everywhere they’ve gone and everything they’ve done on the internet. Social media sites and apps collect this digital data, which can be an exhaustive list of a person’s online history.

What Are the Types of Digital Forensics?

Digital experts may specialize in one or more types of digital forensics. Each area requires a different set of skills and understanding of how to extract and identify digital evidence or restore files lost in a system crash.

Here are some examples.

Database forensics. Digital experts examine databases and metadata. They have an in-depth understanding of database structures and programming languages to sort and extract relevant information.
Malware forensics. Experts identify malicious code to best determine how to neutralize the payload and mitigate the damage.
Network forensics. Digital experts monitor computer network traffic to capture data evidence. Wireless forensics focuses on wireless traffic.
Disk forensics. Digital data experts can find data from storage media, whether from internal or external hard drives or USBs. They can extract data that’s been deleted or damaged in a system crash.
Memory forensics. Forensic experts use several different tools and methods to preserve and retrieve data from system registers, cache and RAM. This data is often fragmentary. If stored in volatile memory, the data can disappear before it can be analyzed.
Mobile phone forensics. With the saturation of mobile phones in the population, they are increasingly being viewed as a source of data. Experts retrieve data from SIM cards, phone logs, text messages and other files.

A digital forensic expert examines a hard drive.

Conducting Digital Forensics Work

Digital forensics work comprises several steps. Each step is crucial in making sure that experts validate the data, protect it from being tampered with and guarantee that the data can be used to support a criminal or legal case. These steps include the following:

Source Identification

What’s the crime and who are the suspects? Where’s the data located? Is it an internal or external breach? Once experts identify the devices they’ll need, they can determine the best methods for extracting data.

Preservation

Before digital forensics experts can search for evidence, they must protect the source devices. They may make a forensic image, or copy, of the hard drive or other device they’re analyzing. They’ll only conduct analysis and data collection in a safe environment. They’ll establish a chain of custody of each device to ensure that it isn’t tampered with.

Data Analysis

Experts use several types of tools to extract and analyze data from various devices. Depending on the source, digital forensics experts may analyze cellphone records, social media posts, database metadata or hidden files on a computer hard drive. In this digital age, analysts will have to sift vast amounts of data using specific techniques. For example:

The cloud. As companies increasingly turn to cloud computing, data is less likely to reside permanently on a hard drive in a physical space. In a security breach, when time is of the essence, security experts may be slowed down by the need to comb vast amounts of data, such as server information; cloud provider logs; and potentially multiple data sources.
Internet of Things. IoT is the interconnection of computing devices with objects that are not traditionally considered computers. IoT forensics focuses on collecting data from these devices, which may include thermostats, cameras and smoke detectors, as well as firewall and IP data.
Mobile devices. Mobile phones and tablets provide forensic analysts with data points ranging from typical audio, video and other files to text messages, GPS data and Bluetooth and Wi-Fi connections.

Presentation

Once analysts have concluded their investigation, they present their findings to clients. Clients can be law enforcement, a judge or a company that suffered a data breach or other attack. In cases in which data and source devices haven’t been properly preserved, the evidence that analysts have collected may not be admissible in court, making all the hard work for naught.

Careers in Digital Forensics

As the collection of digital data continues to increase, the need for digital forensics experts will also grow to help solve both cybercrimes and physical crimes. According to the U.S. Bureau of Labor Statistics (BLS), the demand for forensic science technicians, which includes digital forensics experts, is expected to grow by 16% between 2020 and 2030.

Many careers are available for individuals with information security expertise, including the following:

Forensics Computer Analyst

Forensics computer analysts specialize in computer-based crimes, such as fraud and identity theft. They must adhere to the same standards of evidence gathering as their physical evidence counterparts. They work in police departments or federal agencies, such as the FBI. The median annual salary for forensics computer analysts was approximately $75,000 as of November 2021, according to PayScale.

Information Security Manager

Information security managers are responsible for preventing data breaches. They develop security standards for their organization, establish protocols, install firewalls and encryption software to protect data, and investigate violations. They’re also responsible for developing and carrying out disaster recovery plans. The median annual salary for information security managers was approximately $119,000 as of December 2021, according to PayScale.

Chief information Security Officer

Chief information security officers (CISOs) are responsible for the security operations and strategy for an entire company or organization. Their team of information technology (IT) professionals manages day-to-day security operations. The goal of the CISO is to establish policies to prevent data breaches, mitigate their impact if they happen, and identify and neutralize cyber threats both inside and outside the company. The median annual salary for CISOs was approximately $167,000 as of December 2021, according to PayScale.

Finding Your Niche in Digital Forensics

If using your computer background to help fight crime sounds intriguing, digital forensics may be the career path for you. Digital experts with a cybersecurity and computer background are in high demand. Explore how the online Master of Science in Cybersecurity program at the University of Nevada, Reno can provide the foundation for this rewarding career.

Recommended Reading:

Digital Forensics Analysts: What They Do and How to Become One

How to Become an Information Security Analyst

The Phases of Digital Forensics

Sources:

BetaNews, “Digital Forensics in Modern Cloud Environments”

Computer Security Resource Center, Digital Forensics

CSO, “How the CISO Role Is Evolving”

CyberTalk.org, Alarming Cyber Security Facts to Know for 2021 and Beyond

EC-Council, What Is IOT Forensics? Challenges Ahead and Best Tools to Use

Guru99, “What Is Digital Forensics? History, Process, Types, Challenges”

How Law Firm, Database Evidence