Digital Forensics Techniques and Processes | HiSEC Information Security Laboratory
Research on digital evidence acquisition, integrity verification, timeline reconstruction, and forensic workflow automation.
Digital Forensics Techniques and Processes
Digital evidence must retain procedural reliability and technical reproducibility from acquisition through presentation of findings. This area focuses on reducing the risk of evidence alteration, documenting analytical reasoning, and building tool-supported workflows that allow the same conclusions to be verified from the same data.
Research Questions
How can evidence integrity be verified across acquisition, analysis, preservation, and reporting?; How can incident timelines and user activities be reconstructed in a reproducible way?; How can repetitive analysis tasks be automated while preserving verifiability?
Methods
Evidence imaging, hash verification, and procedural documentation; File system, operating system, and application artifact analysis; Timeline reconstruction, log correlation, and reporting automation
Applications
Digital evidence analysis; Incident investigation; Evidence preservation consulting
Representative Topics
Evidence Acquisition, Integrity Verification, Analysis Process, Forensic Reporting