Digital Forensics

This Open Educational Resource (OER) provides an introduction to the field of digital forensics. Its purpose is to introduce the reader to the concepts that underlie investigations dealing with evidence stored on computer systems. Unlike some other digital forensics training materials, this OER is designed to be application-agnostic and does not require or utilize commercial forensics tools or environments that would require costly software licenses. It is intended to promote a conceptual understanding of legal and technical issues that relate to digital forensics, as opposed to providing a training course on a specific workflow.

Like all my OERs, this material is a work in progress that tends to expand over time. It is a living resource, so there is some potential that direct links to specific pages will break over time. Faculty utilizing this OER in their own courses should periodically check links. Updated locations can be found in the following comprehensive table of contents.

Table of Contents

• Laws, The Courts, and Evidence
  • Basic Legal Concepts
  • The Courts
    • Federal Court System
    • South Carolina Court System
  • Digital Forensic Evidence
• Sources of Evidence
  • Computer Components and Evidence
  • Storage Devices
  • Partitions
  • Filesystems
• Ethics in Digital Forensics
  • Police Interviews
  • Forced Decryption of Data
• Acquisition and Custody of Evidence
  • Scene and Lab Procedures
  • Forensic Hardware
  • Disk Imaging for Digital Forensics
  • SSD Forensics
  • Spoliation
• Public Records and Open-Source Searches
  • Land, Property, and Tax Records
  • Court, Jail, and Sex Offender Records
• Hiding Evidence
  • Steganography
  • The Onion Router
  • Dark Networks

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.