Digital forensics: scope, preservation and costs
Digital forensics examines technical traces to answer a defined question after an incident or within existing data. Acquisition, analysis and recovery are different services. Investigation guarantees neither a complete chronology nor a particular legal outcome.
Agree an answerable investigation question
Specify collection of traces, analysis of existing copies or review of a report. Asking to find everything leaves work and results undefined. State the period and factual question.
An active attack may need parallel containment. Forensics alone does not restore operations. Preservation, security and business requirements need coordinated decisions.
Define sources and limits before examination
Computers, servers, mobile devices, cloud services and logs offer different traces. Access, retention, encryption and previous changes affect examination. A detailed report cannot replace a missing source.
| Source | Clarify the engagement |
|---|---|
| Device / media | Number, type, condition and acquisition options |
| Cloud / account | Authority, export capability and retention |
| Logs / existing copies | Period, provenance and volume |
| Existing report | Defined review question and available foundations |
Plan acquisition with qualified help
Uncoordinated reinstalling, cleanup or further use can change traces. Avoid improvised intervention and obtain qualified direction promptly. No universal instruction to turn every device on or off is appropriate.
The examiner chooses acquisition in light of volatile data and technical condition. Intervention and unavoidable changes need documentation. An ordinary backup is not automatically an adequate forensic image.
Define authority and confidential handover
Before access, clarify commissioning authority, permitted data areas and roles. Disputed rights or proceedings need appropriate legal coordination. An enquiry does not authorise examination of other people’s accounts.
Agree protected transfer, restricted access, retention and return or deletion. Unrelated personal data should not enter the examination without purpose. No passwords, involved persons’ names or evidence files in the initial enquiry.
Request an understandable report
Reports should connect the question, examined sources, methods, findings and limits. Times and time zones need a clear basis. Separate observations from conclusions.
Agree discussion, report language and any additional explanations. Documentation improves traceability without guaranteeing court acceptance or identification of a particular person.
Compare acquisition, analysis and follow-up separately
Effort depends on source count, volume, condition, encryption, period and question. Damaged media or complex cloud access can require separate work. Device count alone does not define comparable analysis.
Specify phases, effort limits and approval of extra work. Travel, storage, detailed analysis, reporting and subsequent explanations should be visible. A low starting fee without analysis scope is incomplete.
| Cost item | Define the quote |
|---|---|
| Initial assessment | Question, sources and feasibility |
| Acquisition | Collection, obstacles and documentation |
| Analysis | Period, search scope and agreed question |
| Report | Findings, limits and discussion |
| Extra work | Recovery, incident help or proceedings support |
Prepare the enquiry and orderly handover
Initial selection needs the requested service, source types, known quantities, current stage and urgency. State the question in the one common brief without sensitive content. Transfer a detailed inventory securely later.
Start with a bounded engagement. After assessment, check whether further sources are necessary. Results, open questions, retention and return should be handed over clearly.
Frequently asked questions
Is forensics data recovery?
No. Forensics answers questions using traces. Recovery aims to restore usable data and may be a separate engagement.
Should I switch off a suspicious device?
Have its actual condition assessed. A general instruction may lose volatile or accessible data.
Can existing copies be sufficient?
Depending on the question, provenance and completeness. Suitability and remaining limits need examination.
Is a complete chronology guaranteed?
No. Missing, changed or unretained data can leave gaps that the report should state.
Can a cloud account be examined?
With clarified authority and actually available data. Export options, logging and retention vary.
What belongs in the initial enquiry?
Source types, quantities, requested work and urgency. No credentials, evidence files or involved persons’ names.
