28. Introduction to Digital Forensics
28.3 Types of Forensics
| Type | What it examines | Example question |
|---|---|---|
| Disk forensics | Hard drives, SSDs, USBs, files (even deleted) | What files existed, when were they made/deleted? |
| Memory forensics | RAM contents (a memory dump) | What was running? Any password or malware in memory? |
| Network forensics | Captured traffic, logs (Chapter 24) | Where did data go? What connected out? |
| Mobile forensics | Phones and tablets | Calls, messages, app data, location |
Deleted files are often recoverable: deleting usually removes only the pointer, not the data, until it is overwritten. Forensic tools "carve" files back from the raw disk. Memory forensics (tools like Volatility) can find things that never touch the disk – exactly why Meterpreter (Chapter 23) is dangerous but still detectable in RAM.
Ravindra Bagale's Tip
"If I delete a file, it's gone" is a misconception – even after emptying the recycle bin, the data stays on the disk until something else is written over that space. So when selling or throwing away a disk with sensitive data, don't just delete – do a secure wipe. This is a practical lesson for students.
Ravindra Bagale's Tip – मराठी
"File delete केली म्हणजे गेली" हा गैरसमज आहे – recycle bin रिकामा केला तरी data disk वर राहतो जोपर्यंत त्या जागेवर दुसरे काही लिहिले जात नाही. म्हणून sensitive disk विकताना किंवा फेकताना नुसते delete नको, secure wipe करा. हा students साठी practical धडा आहे.
Ravindra Bagale's Tip – हिंदी
"File delete की मतलब चली गई" यह गलतफ़हमी है – recycle bin खाली करने के बाद भी data disk पर रहता है जब तक उस जगह पर कुछ और नहीं लिखा जाता. इसलिए sensitive disk बेचते या फेंकते समय सिर्फ़ delete नहीं, secure wipe करो. यह students के लिए practical सबक है.
Practice task
Match each to its type: recovering a deleted photo from a pen drive; finding malware in a RAM dump; tracing where stolen data was uploaded. Write the forensic type for each.