Foundations of Computer Forensics
Introduction
Computer forensics (also referred to as digital computer forensics or computer forensic examination) is the scientific process of identifying, preserving, acquiring, analysing and presenting digital evidence obtained from computer systems in a manner suitable for legal proceedings.
Modern investigations rarely involve a single desktop computer. Instead, investigators encounter interconnected ecosystems consisting of:
- Windows workstations
- Apple macOS systems
- Linux servers
- Virtual machines
- Cloud storage
- Smartphones
- External storage
- Network Attached Storage (NAS)
- USB devices
- Internet browsers
- Email systems
- Collaboration platforms
- Encrypted containers
- Remote access software
Consequently, computer forensics has evolved from simple file recovery into a multidisciplinary science combining operating system architecture, storage technology, cryptography, database analysis, network artefacts and evidential law.
Unlike conventional IT troubleshooting, forensic examination must maintain evidential integrity at every stage. Every action performed by an examiner must be reproducible, documented and capable of independent verification.
What is Computer Forensics?
Computer forensics is the application of scientific methods to recover, preserve, interpret and present digital evidence.
Its objectives include determining:
- What occurred
- When it occurred
- Who performed the activity
- How the activity occurred
- Which systems were involved
- Whether evidence has been altered
- Whether deleted evidence can be recovered
- Whether the findings satisfy the required legal standard of proof
Computer forensic investigations commonly involve:
Investigation Type Typical Evidence
Fraud Financial documents, emails, browser history
Intellectual Property Theft USB activity, cloud synchronisation, copied files
Employment Disputes User activity, logins, document access
Criminal Investigations Images, communications, internet activity
Cybercrime Malware, persistence mechanisms, attacker artefacts
Family Proceedings Communications, metadata, timelines
Regulatory Investigations Audit logs, user accounts, deleted records
Principles of Digital Evidence
Digital evidence differs fundamentally from physical evidence.
Unlike fingerprints or DNA, digital evidence can be altered merely by powering on a computer.
Examples include:
- Log files updating automatically
- Registry modifications
- Temporary files changing
- Browser databases updating
- Cloud synchronisation occurring
- Antivirus scans modifying timestamps
Therefore investigators aim to minimise alteration by employing forensic acquisition techniques.
Characteristics of Digital Evidence
Digital evidence should be:
- Authentic
- Reliable
- Repeatable
- Verifiable
- Complete
- Documented
- Reproducible
Every forensic conclusion should be supported by objective evidence rather than assumption.
The Computer Forensic Process
A standard forensic workflow consists of several stages.
Stage 1 — Identification
Potential evidence sources are identified.
Examples include:
- Desktop computers
- Laptops
- External drives
- SSDs
- USB flash drives
- Memory cards
- Cloud accounts
- Email accounts
- Virtual machines
Stage 2 — Preservation
Evidence is protected from alteration.
Typical actions include:
- Photographing the system
- Recording power state
- Recording connected devices
- Isolating from networks
- Labelling exhibits
- Documenting serial numbers
Stage 3 — Acquisition
A forensic copy is produced.
The acquisition should preserve:
- Allocated space
- Unallocated space
- Slack space
- Deleted files
- Partition information
- File system metadata
Stage 4 — Verification
Cryptographic hashes verify integrity.
Common algorithms include:
Algorithm Status
MD5 Legacy
SHA-1 Legacy
SHA-256 Industry standard
SHA-512 Increasingly common
Example:
Original Evidence
SHA-256
F7B3198A...
Forensic Image
SHA-256
F7B3198A...
Matching hashes demonstrate that the forensic image is an exact duplicate.
Stage 5 — Examination
The examiner extracts artefacts including:
- Registry keys
- Event Logs
- Browser databases
- Email archives
- USB history
- User profiles
- Documents
- Images
- Cloud synchronisation
- Installed software
Stage 6 — Analysis
Analysis transforms artefacts into evidence.
Rather than merely stating:
- Chrome History Exists
- The examiner interprets:
- Which user visited
- Exact timestamps
- Search terms
- Downloads
- Authentication tokens
- Associated files
Stage 7 — Reporting
A forensic report documents:
- Scope
- Methodology
- Tools
- Findings
- Interpretation
- Limitations
- Conclusions
The report should be understandable to judges and juries while remaining technically accurate.
The Order of Volatility
Evidence should generally be collected according to its volatility.
Priority Evidence
1 CPU registers
2 RAM
3 Running processes
4 Network connections
5 Temporary files
6 Disk contents
7 Backups
8 Archived evidence
Highly volatile evidence disappears rapidly after shutdown.
Types of Computer Evidence
Computer investigations commonly recover evidence from numerous sources.
User Data
Includes:
- Documents
- PDFs
- Spreadsheets
- Images
- Videos
- Emails
Operating System Artefacts
Generated automatically by Windows, macOS or Linux.
Examples:
- Registry
- Event Logs
- Prefetch
- Jump Lists
- ShellBags
- Thumbnail Cache
Application Artefacts
Applications generate valuable evidence.
Examples include:
Application Artefacts
Chrome History, downloads, cookies
Edge Sessions, cache
Firefox Places database
Outlook PST/OST files
Teams Logs
OneDrive Synchronisation databases
Network Artefacts
Evidence may include:
- DHCP leases
- Wi-Fi profiles
- VPN configuration
- Firewall logs
- DNS cache
- Browser connections
Cloud Artefacts
Cloud investigations may identify:
- Synchronised folders
- Authentication tokens
- Cached files
- Version history
- Sharing permissions
Live Forensics versus Dead Forensics
Live Forensics
Performed while the computer remains powered on.
Advantages:
- Encryption keys available
- RAM available
- Running processes
- Network connections
- Logged-in sessions
Disadvantages:
- Evidence changes continuously
- Greater contamination risk
Dead Forensics
Performed after storage acquisition.
Advantages:
- Repeatable
- Stable
- Court accepted
- Easier validation
Disadvantages:
- RAM lost
- Encryption keys unavailable
- Volatile evidence unavailable
Storage Media Encountered During Investigations
Investigators may examine:
Device Characteristics
HDD Magnetic storage
SSD Flash memory with TRIM
NVMe PCIe solid-state storage
USB Flash Portable evidence
SD Cards Cameras, drones, phones
RAID Arrays Enterprise systems
NAS Network storage
Virtual Disks VMware, Hyper-V
Each requires different acquisition considerations.
Hard Disk Drives
Traditional magnetic disks store information in sectors organised into tracks.
Characteristics:
- Deleted data often recoverable
- Mature forensic techniques
- Magnetic remanence historically significant
- Slower than SSDs
Solid State Drives
SSDs differ fundamentally.
Characteristics include:
- Flash memory
- Wear levelling
- Garbage collection
- TRIM support
- Dynamic block allocation
These mechanisms can permanently erase deleted data shortly after deletion, making prompt acquisition particularly important.
Evidence Integrity
Evidence integrity underpins every forensic examination.
Investigators maintain integrity through:
- Write blockers
- Cryptographic hashing
- Chain of custody
- Documentation
- Repeatable procedures
Failure to maintain integrity may render evidence unreliable.
Chain of Custody
Every movement of evidence should be documented.
Example:
Date Action Examiner
09:15 Seized laptop Officer Smith
10:05 Bag sealed Officer Smith
11:40 Received laboratory Examiner Jones
13:10 Forensic image acquired Examiner Jones
The chain demonstrates continuous control over the exhibit.
Write Blockers
Hardware write blockers prevent accidental modification of storage devices.
Functions include:
- Blocking write commands
- Allowing read-only access
- Preventing metadata alteration
- Preserving timestamps
Without write blocking, merely connecting a drive to Windows may alter metadata.
Physical versus Logical Acquisition
Physical Acquisition
Captures every readable sector.
Includes:
- Deleted files
- Slack space
- Unallocated space
- File system metadata
Advantages:
- Most comprehensive
- Disadvantages:
- Larger images
- Longer acquisition
Logical Acquisition
Captures active files only.
Advantages:
- Faster
- Smaller
Disadvantages:
- Deleted evidence unavailable
- Slack space unavailable
- Less comprehensive
Common Image Formats
Format Description
RAW (DD) Sector-by-sector copy
E01 EnCase evidence file
AFF Advanced Forensic Format
Ex01 Extended forensic format
Each preserves evidence while allowing verification through cryptographic hashes.
Windows Files Systems, NTFS Internals and Core Forensic Artefacts
Understanding Windows Storage Architecture
A forensic examiner must understand how Windows organises data before interpreting evidence. Modern versions of Windows (Windows 10 and Windows 11) typically store data on GPT-partitioned SSDs formatted using the New Technology File System (NTFS), although removable media may use FAT32 or exFAT.
A simplified storage hierarchy is shown below:
Layer Description Forensic Significance
Physical storage HDD, SSD, NVMe Source of evidence
Partition table GPT or MBR Volume layout, deleted partitions
Volume Logical filesystem Contains user and system data
File system NTFS, FAT32, exFAT Organises files and metadata
Metadata MFT, journals, indexes Reconstructs user activity
User files Documents, media, databases Evidential content
An examiner should always distinguish between physical sectors, partitions, volumes and logical files, as each layer may contain evidential artefacts.
Partition Tables
Master Boot Record (MBR)
The MBR occupies the first sector of a disk and contains:
- Boot code
- Partition table
- Disk signature
Limitations include:
- Maximum of four primary partitions
- Approximately 2 TB maximum disk size
- Single point of failure
Although largely replaced, MBR systems remain common in legacy environments and older forensic examinations.
GUID Partition Table (GPT)
GPT is the standard partitioning system used by modern Windows systems.
Advantages include:
- Supports extremely large storage devices
- Up to 128 partitions by default
- Redundant partition tables
- CRC integrity checking
- UEFI compatibility
Forensic examination of GPT may identify:
- Deleted partitions
- Hidden partitions
- Recovery partitions
- OEM diagnostic partitions
- BitLocker metadata partitions
Windows File Systems
Several file systems may be encountered.
File System Typical Use Key Characteristics
FAT16 Legacy systems Limited capacity
FAT32 USB drives, memory cards No permissions, no journaling
exFAT Large removable media Supports large files
NTFS Windows system drives Journaling, permissions, metadata
ReFS Enterprise servers Integrity streams, resilience
NTFS remains the most important file system in computer forensic investigations.
NTFS Architecture
NTFS stores substantially more than file contents. It maintains extensive metadata describing every object stored on the volume.
Core NTFS components include:
- Boot sector
- Master File Table (MFT)
- MFT Mirror
- Bitmap
- LogFile
- USN Change Journal
- Security descriptors
- Directory indexes
- Attribute lists
Unlike FAT-based systems, virtually every file operation generates metadata that may later become evidential.
The NTFS Boot Sector
The NTFS boot sector contains information including:
- Bytes per sector
- Sectors per cluster
- Cluster size
- Volume serial number
- MFT starting cluster
- MFT Mirror location
Corruption of the boot sector may indicate:
- Disk failure
- Malware
- Encryption
- Anti-forensic activity
Master File Table (MFT)
The MFT is the heart of NTFS.
Every file and directory possesses at least one MFT record.
This includes:
- Documents
- Images
- Folders
- System files
- Deleted files (until reused)
- Metadata files
Even the MFT itself has an MFT entry.
Typical MFT Record Structure
Each MFT record contains attributes rather than a fixed structure.
Common attributes include:
Attribute Purpose
$STANDARD_INFORMATION File timestamps and flags
$FILE_NAME Filename metadata
$DATA File contents
$SECURITY_DESCRIPTOR Access control
$INDEX_ROOT Directory indexing
$ATTRIBUTE_LIST Large file attributes
$OBJECT_ID Object tracking
$REPARSE_POINT Symbolic links and junctions
Understanding these attributes is fundamental when reconstructing activity.
Resident and Non-Resident Data
Small files may be stored directly within the MFT record (resident).
Larger files are stored elsewhere on disk (non-resident), with the MFT containing pointers to the data clusters.
This distinction becomes important when recovering deleted files or analysing fragmented data.
File Reference Numbers
Each MFT entry has a unique reference number.
These identifiers allow Windows to locate files even after:
- Renaming
- Moving directories
- Updating metadata
Consequently, a file may retain the same MFT reference while its filename changes multiple times.
NTFS Timestamps
One of the most frequently misunderstood areas of computer forensics involves timestamps.
NTFS stores multiple timestamp sets.
$STANDARD_INFORMATION
Contains:
- Creation time
- Modification time
- MFT modification time
- Last access time
$FILE_NAME
Stores another independent timestamp set.
Comparing the two may reveal:
- File copying
- Renaming
- Timestamp manipulation
- Anti-forensic activity
MACB Times
Investigators often summarise NTFS timestamps using the acronym MACB.
Timestamp Meaning
Modified (M) File contents changed
Accessed (A) File opened or read
Changed (C) Metadata changed
Born (B) File created
Careful interpretation is essential, as not every user action updates every timestamp.
Timestamp Interpretation Example
Suppose an image file has the following metadata:
Timestamp Date
Created 15 March 2026 10:15
Modified 15 March 2026 10:15
Metadata Changed 2 April 2026 14:08
Accessed 2 April 2026 14:08
This may indicate that the file itself was created in March but viewed, copied or had permissions modified in April.
An examiner should avoid concluding that the file was created in April without considering all available evidence.
NTFS Journaling
NTFS uses transaction journaling to improve reliability.
Two important journals are:
- $LogFile
- USN Change Journal
These frequently provide valuable historical evidence.
$LogFile
Location:
\$LogFile
Purpose:
Records filesystem transactions
Supports crash recovery
Tracks metadata updates
Evidence may include:
File creation
Renaming
Deletion
Directory movement
Metadata modification
Although primarily intended for recovery, forensic tools can reconstruct historical activity from journal records.
USN Change Journal
Location:
\$Extend\$UsnJrnl
The Update Sequence Number (USN) Journal records file changes occurring on the volume.
Typical events include:
File creation
File deletion
Rename operations
Security changes
Data overwrites
Hard link creation
Unlike ordinary timestamps, the USN Journal provides a chronological history of filesystem events.
Example USN Entry
Time
Event
09:02
report.docx created
09:15
report.docx modified
09:17
report.docx renamed
09:20
report.docx deleted
Even if the document is later deleted, journal entries may remain until overwritten.
NTFS Bitmap
The bitmap records cluster allocation.
It indicates:
Allocated clusters
Free clusters
Available space
Investigators use bitmap analysis during:
Deleted file recovery
Fragment reconstruction
Validation of overwritten sectors
MFT Mirror
NTFS stores a partial duplicate of the MFT.
Purpose:
Recovery after corruption
Filesystem resilience
Although rarely examined directly, the mirror may assist when the primary MFT is damaged.
Alternate Data Streams (ADS)
NTFS supports multiple data streams within a single file.
Example:
Report.docx
may contain:
Report.docx:hidden.txt
The hidden stream is not visible through normal Windows Explorer views.
ADS may be used legitimately for metadata, but has also been exploited to conceal malicious tools or data.
Slack Space
Slack space is the unused area between the logical end of a file and the end of its allocated cluster.
Example:
Cluster size:
4096 bytes
File size:
3000 bytes
Slack:
1096 bytes
Slack may contain remnants of previously stored data, making it a valuable source of historical evidence.
Unallocated Space
When a file is deleted, Windows generally marks its clusters as available rather than immediately erasing them.
Unallocated space may therefore contain:
Deleted documents
Images
Database fragments
Browser artefacts
Registry remnants
Email content
Recovery depends on factors including SSD TRIM operations, overwrite activity and filesystem behaviour.
File Carving
Where filesystem metadata has been destroyed, investigators may recover files using file carving.
Rather than relying on filenames, carving identifies files by known signatures.
Example signatures include:
File Type
Header
JPEG
FF D8 FF
PNG
89 50 4E 47
ZIP
PK
Carving can recover evidence from damaged or reformatted media, although filenames and original directory structures are often lost.
Windows Recycle Bin
Deleting a file via Windows Explorer typically moves it to the Recycle Bin.
Modern systems store metadata under:
C:\$Recycle.Bin\
Each deleted file is represented by:
$R… – the file data.
$I… – metadata describing the original file.
The metadata includes:
Original filename
Original path
Original file size
Deletion timestamp
This allows investigators to determine not only what was deleted but also where it originally resided.
Windows Registry Overview
The Windows Registry is a hierarchical database storing operating system and application configuration.
It is one of the richest sources of forensic evidence because it records user actions, system configuration, connected devices and application usage.
The primary Registry hives include:
Hive
Purpose
SYSTEM
Hardware configuration, services, boot information
SOFTWARE
Installed applications and OS settings
SAM
Local user accounts
SECURITY
Local security policy
NTUSER.DAT
Per-user settings and activity
UsrClass.dat
Shell and application settings
The Registry will be examined in depth in Part 3.
Registry File Locations
Hive
Default Path
SYSTEM
C:\Windows\System32\Config\SYSTEM
SOFTWARE
C:\Windows\System32\Config\SOFTWARE
SAM
C:\Windows\System32\Config\SAM
SECURITY
C:\Windows\System32\Config\SECURITY
DEFAULT
C:\Windows\System32\Config\DEFAULT
NTUSER.DAT
C:\Users\<Username>\NTUSER.DAT
UsrClass.dat
C:\Users\<Username>\AppData\Local\Microsoft\Windows\UsrClass.dat
These hives are commonly extracted during forensic acquisition and parsed using specialised forensic software.
Investigation Example – Recovering a Deleted Confidential Report
A company suspects that an employee intentionally deleted a confidential report before leaving the organisation.
A forensic image of the employee’s Windows 11 laptop is acquired using a hardware write blocker and verified using SHA-256 hashing. Examination reveals no copy of the report within the active filesystem. However:
An $I file within C:\$Recycle.Bin\ identifies the original filename, path and deletion timestamp.
The associated $R file contains the complete document.
The MFT confirms the file’s creation, modification and deletion chronology.
The USN Change Journal records the rename and deletion events.
Slack space analysis identifies fragments of an earlier draft.
Together, these artefacts allow the examiner to reconstruct the lifecycle of the document and demonstrate that it was deliberately deleted shortly before the employee’s departure.
Coming in Part 3
The next part will examine the Windows Registry in forensic detail, including:
Registry architecture (hives, bins, cells and keys)
Registry transaction logs
LastWrite timestamps
UserAssist
RecentDocs
RunMRU
ShellBags
BAM and DAM
USBSTOR
MountedDevices
AppCompatCache (ShimCache)
Amcache
Windows Event Logs
Practical investigation examples demonstrating how Registry artefacts establish user activity and support expert witness evidence.
