28. Introduction to Digital Forensics
28.2 Core Principles
Forensics che kahi niyam kadhihi modaayche nahit:
| Principle | Meaning |
|---|---|
| Preserve the original | Never work on the original device; it must not change |
| Work on a copy (image) | Make a bit-for-bit copy and examine that |
| Prove integrity with hashing | Hash the original and the copy; equal hashes prove nothing changed |
| Chain of custody | Document who handled the evidence, when, and why – every step |
| Use a write blocker | Hardware/software that lets you read a disk without writing to it |
| Document everything | Notes, timestamps, tools and versions, screenshots |
Hashing for integrity (you met hashing in Chapter 22): compute a hash of the evidence when you collect it; anyone can recompute it later and confirm the data is unchanged.
sha256sum evidence.dd # hash a disk image
sha256sum evidence.dd > evidence.dd.sha256 # record it
sha256sum -c evidence.dd.sha256 # later: verify it still matches
Ravindra Bagale's Tip
Sarvat mothi forensic chuk: original device var thet kaam karne. Ekda tumhi live disk var kahi kela ki purava badalto ani court to nakarto. Nehmi: image ghya, hash ghya, ani copy var kaam kara. Ha ekach niyam professional ani amateur madhla farak aahe.
Practice task
Create a small file, compute its SHA-256, then change one character and hash again. Note how completely the hash changes – explain in one line why this proves integrity.