# Digital Forensics **Domain:** Cybersecurity / Investigation / Evidence **Doc Type:** Canonical Practice Node **Maturity:** Foundational ## Definition **Digital forensics** identifies, preserves, examines and interprets evidence from computers, mobile devices, networks, cloud services and other digital systems. ## Evidentiary Context Forensic reconstruction distinguishes observed artifacts from hypotheses about cause, sequence and actor. Reliable analysis depends on preservation, chain of custody, tool limits and the integrity of the systems from which evidence is collected. ## See Also [[wiki/Provenance|Provenance]], [[wiki/Incident Response|Incident Response]], [[wiki/Cyber Attribution|Cyber Attribution]], [[wiki/Authentication|Authentication]] ## Relationships - **marketplace reading route:** [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]]. - **source article:** [[articles/The Coming Market for Civilian Spycraft|The Coming Market for Civilian Spycraft]]. ## Connected marketplace roles The source article connects this entry with [[wiki/Phone Extraction|Phone Extraction]]. These routes locate the associated people, implementations, methods, and operational contexts in [[articles/The Coming Market for Civilian Spycraft|The Coming Market for Civilian Spycraft]]. **Collections:** [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]].