Ravi Sir's Cyber Security Cards › Revision Cards
Types of Forensics
Types of Forensics The main areas of digital forensics: disk , memory , network and mobile . Deleted files are often recoverable. Deleting usually removes only the pointer, not the data, until it is overwritten. Memory forensics (tools like Volatility) can find things that never touch the disk. In-m
Read card text
What this card says
What it is
The main areas of digital forensics: disk, memory, network and mobile.
Key facts
Deleted files are often recoverable. Deleting usually removes only the pointer, not the data, until it is overwritten.
Memory forensics (tools like Volatility) can find things that never touch the disk.
Why it matters for security
In-memory malware like Meterpreter leaves little on disk, but can still be found in RAM.
| Type | What it examines | Example question |
|---|---|---|
| Disk forensics | Hard drives, SSDs, USBs, files (even deleted) | What files existed, when were they made/deleted? |
| Memory forensics | RAM contents (a memory dump) | What was running? Any password or malware in memory? |
| Network forensics | Captured traffic, logs (Chapter 24) | Where did data go? What connected out? |
| Mobile forensics | Phones and tablets | Calls, messages, app data, location |
Learn more in the lesson: 28.3 Types of Forensics