# Digital Forensics **Domain:** Cybersecurity / Investigation / Evidence **Doc Type:** Canonical Practice Node **Maturity:** Foundational ## Definition **Digital forensics** identifies, preserves, examines and interprets evidence from computers, mobile devices, networks, cloud services and other digital systems. ## Evidentiary Context Forensic reconstruction distinguishes observed artifacts from hypotheses about cause, sequence and actor. Reliable analysis depends on preservation, chain of custody, tool limits and the integrity of the systems from which evidence is collected. ## See Also [[wiki/Provenance|Provenance]], [[wiki/Incident Response|Incident Response]], [[wiki/Cyber Attribution|Cyber Attribution]], [[wiki/Authentication|Authentication]]