28. Introduction to Digital Forensics
28.3 Types of Forensics
| Type | What it examines | Example question |
|---|---|---|
| Disk forensics | Hard drives, SSDs, USBs, files (even deleted) | What files existed, when were they made/deleted? |
| Memory forensics | RAM contents (a memory dump) | What was running? Any password or malware in memory? |
| Network forensics | Captured traffic, logs (Chapter 24) | Where did data go? What connected out? |
| Mobile forensics | Phones and tablets | Calls, messages, app data, location |
Deleted files are often recoverable: deleting usually removes only the pointer, not the data, until it is overwritten. Forensic tools "carve" files back from the raw disk. Memory forensics (tools like Volatility) can find things that never touch the disk – exactly why Meterpreter (Chapter 23) is dangerous but still detectable in RAM.
Ravindra Bagale's Tip
"File delete keli mhanje geli" ha gairsamaj aahe – recycle bin rikama kela tari data disk var rahto joparyant tya jagevar dusre kahi lihile jat nahi. Mhanun sensitive disk viktana kiwa deta phektana nusta delete nako, secure wipe kara. Ha students la practical dhada.
Practice task
Match each to its type: recovering a deleted photo from a pen drive; finding malware in a RAM dump; tracing where stolen data was uploaded. Write the forensic type for each.