What is Digital Forensics?
Digital forensics is the process of uncovering and interpreting electronic data. The goal of the process is to preserve any evidence in its most original form while performing a structured investigation by collecting, identifying and validating the digital information for the purpose of reconstructing past events.
The context is most often for usage of data in a court of law, though digital forensics can be used in other instances as well.
What does it entail?
In short, a digital forensics expert's goal is to gain access to an electronic device's memory, to include any recently deleted items, and make a forensic copy, while leaving the original information intact. The expert is then able to search and analyze the copy for the information/evidence relevant to the situation. Once his analysis is complete, a report is generated that present the findings in a coherent and usable format. This product is further supported, if necessary, by the expert's testimony in court.
The evidentiary nature of digital forensics requires rigorous standards to stand up to cross-examination in court. Our digital forensics expert has passed the legal standard required to testify as an expert witness, and has done so many times.