Digital forensics

Digital forensics covers the identification, preservation, analysis and documentation of digital evidence. It differs from incident response in one demand: every step must survive later scrutiny by a third party – authority to access, an unbroken chain of custody, integrity proven by hash values, validated tools, a repeatable method and a report that can stand as expert testimony. For a company this matters the moment an incident touches insurance, a regulator, a criminal complaint or employment law. What counts then is not what you know, but what you can prove.