Computer forensics is the disciplined collection and analysis of digital evidence from computers and related systems. It preserves data integrity so findings can support investigations, legal proceedings, and incident response. Practitioners recover artifacts, trace user and system activity, and document a defensible chain of custody across devices, logs, and storage media.
What Computer Forensics Covers
Computer forensics is the disciplined process of preserving, collecting, and examining digital evidence so investigators can reconstruct activity without compromising data integrity. It is as much about defensible handling as it is about technical analysis.
The field spans computers and related systems, including disks, memory, logs, removable media, and other sources of artifact evidence. Good practice focuses on what happened, when it happened, and whether the resulting findings can stand up in an investigation or court.
Evidence Handling and Chain of Custody
Computer forensics begins with preserving evidence in a way that avoids altering the original source. That usually means controlled acquisition, clear documentation, and handling rules that show where the evidence came from, who touched it, and what changed during collection.
Chain of custody is not a paperwork formality, it is the basis for evidentiary trust. If acquisition methods, timestamps, storage media, or examiner actions are not recorded carefully, the analysis may still be technically interesting but lose probative value.
For practitioners, the core idea is that forensic work must be repeatable and explainable. The evidence trail should make it possible for another examiner, or a legal reviewer, to understand how the conclusion was reached.
Artifacts, Timelines, and Reconstruction
A forensic examination is usually driven by artifacts rather than by a single source of truth. Browser history, registry data, event logs, file metadata, execution traces, and volatile memory can each reveal a different part of user or system behavior.
When those artifacts are correlated, investigators can build timelines that show activity before, during, and after an event. That reconstruction is often the most valuable output of computer forensics because it turns scattered traces into a sequence that supports incident response or legal review.
Computer forensics is therefore both analytical and interpretive. The examiner must distinguish between direct evidence, supporting evidence, and artifacts that are merely consistent with a theory but do not prove it on their own.
Use in Investigations, Response, and Legal Contexts
Computer forensics supports incident response by helping teams determine scope, initial access, persistence, lateral movement, and post-compromise activity. It also supports legal proceedings where the evidence must be collected and presented in a way that is credible, documented, and technically defensible.
That dual use creates a higher standard than ordinary troubleshooting. A rushed review may be enough to restore operations, but forensic work must also preserve integrity for later scrutiny, which is why acquisition, analysis, and reporting are treated as separate disciplines.
For readers who want the broader practice model, Digital Forensics (DFIR) Guide covers evidence handling, chain of custody, and the forensic workflows that sit around this term.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Computer forensics depends on logged activity to reconstruct events and prove evidentiary sequence. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Forensic analysis turns audit records into findings, timelines, and defensible conclusions. | |
| SI-4 — System Monitoring | Forensic readiness improves when systems are monitored to capture evidence of suspicious activity. | |
| Recommendation — Log the events needed to reconstruct investigations and preserve traceability for later review. Review audit records to correlate artifacts, identify sequences, and support incident findings. Monitor systems so suspicious activity is captured early enough for later forensic analysis. | ||