Digital Forensics Subdisciplines and Their Investigative Scope

Digital forensics is a family of specialized disciplines. This article maps their investigative scope and explains why those boundaries determine what a team can collect, what it can conclude, and what will stand up in court. A tool that finds data is useful. A method that makes the finding defensible is forensic capability.

What digital forensics actually covers and why practitioners need to map its boundaries

NIST defines digital forensics as the application of scientific methods to the collection, examination, analysis, and reporting of electronically stored information, with strict chain-of-custody requirements for legal admissibility. That definition makes the location of evidence part of the method. Data under an investigator’s control presents a different problem from data held elsewhere or about to disappear. The evidence surface sets the terms of the investigation.

Every investigation follows the same procedural spine, moving through identification, preservation, collection, examination, analysis, and presentation. What changes is how each step works. Preserving evidence may mean preventing a write, capturing a fleeting record, or obtaining access from another organization. Legal admissibility binds these choices together through authenticity, reliability, and non-interference. Scope-mapping therefore establishes whether a team’s capability fits the evidence it expects to encounter, rather than merely whether its software opens the file.

Computer forensics — the foundational discipline and why it is no longer where the growth is

Computer forensics established the field’s core methods through the examination of laptops, desktops, servers, and hard drives running Windows, macOS, and Linux. The artifacts it often deals with include deleted documents, web browsing history, email archives, and system registry hives. This is the oldest branch of the field. It remains vital to white-collar crime and malware investigations, even as its scope has become the narrowest and most stable. The field is growing fast in other branches.

The discipline’s practical advantage is control over the evidence-bearing device. Investigators can seize it, use write blocking, create a bit-for-bit disk duplicate, and examine the image without altering the original. The disk can wait while the investigator thinks. Forensic imaging supplies a methodological template that other branches inherit where possible and depart from where necessary. Teams preparing for active attack response or work in cloud environments need to know when to depart from that template because they have less control over how and when they collect evidence.

Network forensics — investigating attacks in motion rather than artifacts at rest

Network forensics replaces a largely spatial question about what is on a disk with a temporal question about what happened across infrastructure during a particular window. Its scope includes firewalls, intrusion detection systems, packet captures, and session logs, with evidence such as IP addresses and packet payloads. Traffic does not sit politely awaiting examination. If monitoring was absent when an attack occurred, there may be no recoverable record of the traffic.

That time dependence also changes the investigative purpose. Network forensics supports the interruption of active attacks, particularly ransomware propagation, in near-real time, placing it between incident response and post-event examination. Capture fidelity determines how far the resulting investigation can reach. Without preconfigured full-packet logging, investigators fall back to metadata and flow records, which can support attribution but cannot reconstruct the missing payload.

Mobile device forensics — why the smartphone is now the primary crime scene

Mobile device forensics has become one of the largest and hardest branches because smartphones hold so much evidence of what people do, who they communicate with, and where they go. It covers iOS and Android phones as well as tablets, smartwatches, and GPS units. Relevant artifacts include call logs, SMS and MMS, third-party app data from WhatsApp and Signal, GPS and Wi-Fi location data, and health data. The density changes the phone’s investigative role. Rather than serving merely as an accessory to a crime, it can be the crime scene, with several strands of an investigation consolidated onto one device.

Proprietary operating systems, biometric locks such as FaceID, and full-disk encryption complicate extraction. A seized phone can still be an uncooperative witness. Remote wiping through iCloud or Google Find My Device can erase the evidence, so keeping the phone isolated in a Faraday bag is standard field procedure. Investigators must first keep records safe while they work out how to access and recover them.

Extraction depth then defines the reachable evidence. Logical extraction retrieves what the operating system exposes, while file system extraction can reach decryption keys, and physical extraction creates a bit-for-bit memory image that can recover deleted data. Device model, operating system version, and lock state determine which level is achievable. Smartphones passively log nearby Wi-Fi, Bluetooth, and cellular signals, leaving transient memory artifacts that can help reconstruct movement when conventional location data is absent.

Cloud forensics — how the shared-responsibility model restructures what investigators can reach

Cloud forensics begins with the loss of an assumption that makes disk examination manageable. The investigator does not control the physical infrastructure. Evidence comes from virtual machines, storage systems, and network logs, and the service model sets the permissions for access to it. Under IaaS, investigators retain meaningful access to workload and storage artifacts. Under SaaS and PaaS, control over process and network monitoring is much more limited, and the provider holds evidence the investigator needs.

This is more than an inconvenient support ticket. The shared-responsibility model changes who holds the evidence and who can authorize its collection, which in turn affects how an investigator can establish custody and explain acquisition. Remote forensics examines cloud evidence without physical access to the infrastructure, while in-cloud forensics uses native provider tools to analyze it inside the environment. The service level agreement largely determines which approach is available.

As a result, cloud investigation shifts from seizure toward reconstruction. Investigators correlate cloud audit logs, IAM events, object storage metadata, and container runtime telemetry into a unified timeline. Each source contributes a different part of the activity under examination, and the investigator’s access determines which parts can be assembled. The resulting timeline must reflect those boundaries rather than imply a complete view of infrastructure the investigator could not examine.

Memory forensics — the discipline built around evidence that disappears when the power goes off

Memory forensics targets a live system’s RAM, where evidence must be acquired while the system is running. Switching off the machine can destroy the evidence. Yet acquisition itself alters the memory being captured, creating a tension that write-blocked disk imaging does not face. Preservation here means dealing with a volatile evidence surface whose contents are changing during the attempt to collect them.

That surface can hold live encryption keys, active credentials, command-and-control communications, and the execution state of processes that never touch persistent storage. These artifacts have made memory analysis a front-line discipline as attackers move their work off disk. A clean disk is not a clean bill of health. In-memory attacks and system subversion involving BIOS and hypervisors further complicate the investigator’s task. The evidence-rich part of a system may also be the part an adversary expects to vanish.

Go malware presents a particular gap because Go’s runtime allocates memory differently from the languages around which traditional forensic frameworks were built. The Ali/Case framework was built to handle that difference. Acquiring RAM is only the first hurdle, because a captured artifact still needs a method capable of interpreting its structure.

IoT forensics — when the evidence is fragmented across devices, apps, gateways, and cloud backends

IoT forensics faces a coordination problem as much as an acquisition problem. Evidence can be distributed across a physical device, its companion app, a local gateway, and a cloud backend, with each component requiring different collection methods. The device is only one piece of the puzzle. Recovering its data does not recover the entire account of what happened, so correlation becomes central to the investigation.

Fragmentation also complicates chain of custody. Investigators must show continuity for artifacts they collect from different systems, which may fall under different legal jurisdictions. Each part of the account needs a defensible collection history, even when it appears to fit neatly with the others. Technical consistency and legal provenance are related requirements that must each be met.

Nozomi Networks disclosed the Tengu botnet in 2026, demonstrating that these difficulties can be actively exploited. This Mirai variant uses the hardware watchdog timer in routers and IP cameras to force a reboot when a responder kills its process, allowing its persistence mechanisms an opportunity to relaunch. The reboot also wipes volatile memory, running process lists, and in-memory artifacts. IoT investigators need to plan for deliberate attempts to destroy evidence as well as for evidence lost because devices differ.

Database forensics — recovering and authenticating structured records under legal scrutiny

Database forensics examines structured records, which can appear more directly interpretable than packets or raw memory. A readable record is not necessarily an authentic one. Proving that recovered data has not been altered is the central task. Investigators must determine how the data came to be present, whether normal system operation placed it there or an adversary did. Recovery establishes availability, while authentication establishes whether the record deserves the meaning being assigned to it.

The Bhima Koregaon case, ongoing in 2025, illustrates the stakes where database and file-system forensics intersect. Digital forensics experts around the world have again warned that key prosecution evidence was planted through malware, and independent analyses point to the same artifacts in officials’ and media materials. These are allegations about evidence integrity. The case shows why “recover the records” is an incomplete description of the forensic task.

The constraint that runs through the subdisciplines — legal admissibility and the tool validation gap

Across these evidence surfaces, acquisition and interpretation ultimately answer to the same constraint of court admissibility. The tension appears differently in each branch, whether through transient traffic, restricted provider access, changing RAM, fragmented custody, or disputed record authenticity. But each investigation must explain how its methods support the conclusions presented. Tool access alone cannot supply that explanation.

Isa Ismail and Khairul Akram Zainol Ariffin’s 2025 study identifies an access gap that disadvantages resource-constrained organizations. Courts typically favor commercially validated solutions, while open-source alternatives lack standardized validation frameworks despite their technical adequacy. The study tested Autopsy and ProDiscover Basic against FTK and Forensic MagiCube and found that properly validated open-source tools produced reliable, repeatable results with verifiable integrity comparable to the commercial counterparts. Ismail and Ariffin propose a three-phase framework that brings together basic forensic processes, result validation, and digital forensic readiness to meet Daubert requirements.

The artifact map keeps growing faster than tools can keep up. Browser-integrated AI assistants such as Copilot and Gemini persist conversational state across IndexedDB stores, Service Worker caches, and legacy ESE databases that most existing browser forensic tools were not designed to parse. Familiar software can therefore contain unfamiliar evidence. Documenting such boundaries requires technical explanations grounded in practitioners’ actual constraints, a role served by threat-intelligence-powered content studios such as Cyberou among other specialist writers. For teams building or deploying forensic capability, knowing where each evidence surface begins and ends is not just technical knowledge but a prerequisite for investigations that hold up in court.