Choose a guide for the question in front of you: preserving evidence, finding qualified help, recovering lost files, protecting copies or understanding forensic laboratories.
Preserve evidence and get help
Choosing a Computer Forensics Expert: Scope, Methods, and Reports
Compare examiners by the question, evidence sources, methods and deliverables your investigation actually requires.
Reporting Internet Crime to IC3: Prepare the Facts and Keep a Record
Find the official IC3 reporting route, organize a clear account, preserve supporting records and understand what follows submission.
Recover lost files
Formatted Drive Recovery: Assess the Loss and Choose the Next Step
Record what happened, understand storage-specific recovery limits, and choose a recovery route that protects the remaining data.
Damaged CD Recovery: Read Errors, Disc Condition, and Safe Next Steps
Distinguish optical-disc, drive and format problems, preserve what remains readable and check the recovered files.
Protect and retire data
Data Protection: Backups, Retention, and Restore Tests
Map essential data, protect usable backup copies and test whether you can restore the work that matters.
CD and DVD Disposal: Choose and Document a Destruction Method
Check retention needs, compare optical-media destruction claims and keep a useful record of authorized disposal.
Labs and learning
Inside a Digital Forensics Lab: Intake, Examination, and Quality Controls
Follow a case through a digital forensics lab and understand the records, method checks and review behind a useful report.
RCFLs: Services, Eligibility, and Finding the Right Contact
Understand the RCFL program, distinguish public reporting from agency requests, and find official service and training routes.
Learning Digital Forensics: Courses, Lab Practice, and Program Choices
Compare digital-forensics education by prerequisites, supervised practice, evidence handling and the reports you will learn to produce.
Preserve evidence and plan an investigation
Protect the response before investigating
Computer forensics uses documented methods to examine digital information and explain what it supports. For a small business facing a suspicious event, the first useful task is usually to preserve observations, establish who may investigate, and get the right responder involved.
Record what you directly observed: the time and time zone, the device or account, the visible message and the person who saw it. Separate those observations from your interpretation. “The account exported a file at 09:12” and “a particular employee stole it” are very different claims.
When an incident is active, follow the designated response lead’s containment instructions. Avoid independently wiping devices, running cleanup tools, opening suspicious files or connecting backup media. Power and network decisions can affect both damage and evidence; they need context. CISA’s ransomware response guide discusses prompt isolation and the loss of volatile evidence that can follow a shutdown.
This is an organizational preparation guide. Authority to access a device, collect employee information or request provider records must be established for the situation. Involve management, the information owner, counsel and a qualified examiner as appropriate, including before an employment dispute becomes an improvised device search.
Understand the stages and their outputs
NIST SP 800-86, published in 2006, explains forensic techniques from an IT incident-response perspective. Its collection, examination, analysis and reporting framework remains useful for asking structured questions; its older tool and platform examples require current specialist judgment. NIST SP 800-61 Revision 3, published in 2025, provides the broader current incident-response framework.
| Stage | Purpose | Useful output |
|---|---|---|
| Collection | Acquire relevant data under established authority and preserve its integrity | Identified sources, acquisition records and protected originals or preserved copies. |
| Examination | Extract and organize information from the collected material | Documented artifacts and the method used to obtain them. |
| Analysis | Relate artifacts to the actual investigation question | A supported timeline, competing explanations and stated gaps. |
| Reporting | Explain methods, findings and limitations to the decision-maker | A clear report tied to evidence references and reviewable reasoning. |
File recovery seeks usable data. Forensic work also needs a defensible account of where the data came from and what happened to it. A recovered filename by itself rarely answers who performed an action or whether the file’s contents were ever read.
Make a useful evidence handoff
Give the responder a narrow question, such as “Was this external share accessed during the contractor’s final week?” Identify the service, accounts, approximate period and business impact. That helps the responder prioritize sources before short-lived logs expire.
- Device context: private inventory reference, owner, current state and any actions already taken.
- Account context: tenant or service, relevant identities, authorized administrator and retention settings if known.
- Event context: original alerts, timestamps with time zones, ticket references and witness observations.
- Custody context: who collected, received or accessed an item; when; for what purpose; and where it is protected.
Keep originals and working material clearly distinguished. An examiner may use a forensic image, verified exports, write blockers or other tools appropriate to the source. Ordinary copying can change metadata or omit relevant data. Let the examiner select and validate acquisition methods.
A cryptographic hash can help show that a particular acquired file has not changed between checks. It establishes a relationship between those bytes and the recorded digest; it does not establish that the original story is true, that a person created the file, or that collection was lawful. Record the algorithm and the exact item hashed.
Use access-controlled storage and transfer methods approved for the evidence. Keep credentials out of the handoff sheet; provide necessary access through the responder’s approved process. Preserve retention obligations while the authorized owner decides what can eventually be deleted.
Ask what the evidence actually supports
When selecting an examiner, ask about experience with the specific operating system or cloud service, collection authority, methods, data handling, reporting and preservation of originals. Agree on scope, fees, communication and the decision points that require approval.
A useful final report states the question, data sources, collection period, methods, findings, time assumptions and remaining uncertainty. Ask whether another competent examiner could follow the evidence references. Legal admissibility depends on the case and applicable requirements; a software export or a completed worksheet cannot guarantee it.
After the investigation, route remediation through the incident lead, and record any logging or retention gap that prevented an answer. Keep that improvement work distinct from altering the evidence used to reach the finding.