Data Forensics

What Does Data Forensics Mean?

Data forensics, often used interchangeably with computer forensics, is essentially the study of digital data and how it is created and used for the purpose of an investigation. Data forensics is part of the greater discipline of forensics, in which various types of evidence are studied to investigate an alleged crime.


Techopedia Explains Data Forensics

Data forensics can involve many different tasks, including data recovery or data tracking. Data forensics might focus on recovering information on the use of a mobile device, computer or other device. It might cover the tracking of phone calls, texts or emails through a network. Digital forensics investigators may also use various methodologies to pursue data forensics, such as decryption, advanced system searches, reverse engineering, or other high-level data analyses.

Some experts make a distinction between two types of data collected in data forensics. One is persistent data, which is permanently stored on a drive and is therefore easier to find. The other is volatile data, or data that is transient and elusive. Data forensics often focuses on volatile data, or on a mix of data that has become difficult to recover or analyze for some reason. In other cases, data forensics professionals focus on persistent data that is easy to come by but must be assessed in depth in order to prove criminal intent.


Related Terms

Margaret Rouse

Margaret is an award-winning technical writer and teacher known for her ability to explain complex technical subjects to a non-technical business audience. Over the past twenty years, her IT definitions have been published by Que in an encyclopedia of technology terms and cited in articles by the New York Times, Time Magazine, USA Today, ZDNet, PC Magazine, and Discovery Magazine. She joined Techopedia in 2011. Margaret's idea of a fun day is helping IT and business professionals learn to speak each other’s highly specialized languages.