digital forensics

{
  "id": "MLC-T-CYB-001374",
  "term": "digital forensics",
  "field": "Cybersecurity",
  "definition": "1. In its strictest connotation, the application of computer science and investigative procedures involving the examination of digital evidence - following proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatability, reporting, and possibly expert testimony.\n\n2. The application of science to the identification, collection, examination, and analysis, of data while preserving the integrity of the information and maintaining a strict chain of custody for the data.\n\n3. The process used to acquire, preserve, analyze, and report on evidence using scientific methods that are demonstrably reliable, accurate, and repeatable such that it may be used in judicial proceedings",
  "synonyms": [
    "computer forensics"
  ],
  "references": [
    "CNSSI 4009-2022 from DoDD 5505.13E",
    "NIST SP 800-86",
    "NISTIR 8006 from SWDGE v2.0",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/digital-forensics/"
}