Leanpub Header

Skip to main content

Digital Forensics: A Practical Guide to Modern Investigations

From Evidence Acquisition to Advanced Analysis

This book is 100% completeLast updated on 2026-07-30

Discover how to uncover, preserve, and analyze digital evidence with confidence. From fundamental forensic principles to advanced investigative techniques, this practical guide combines hands-on exercises, real-world case studies, and industry-standard tools to help you conduct modern digital investigations with accuracy and credibility.

Minimum price

$19.00

$29.00

You pay

Author earns

$

Also available for 1 book credit with a Reader Membership

PDF
EPUB
WEB
APP
235
Pages
About

About

About the Book

This is a comprehensive, hands-on guide to digital forensics that takes you from the foundational principles of evidence handling through advanced investigative methodologies used by professional investigators. Every chapter provides actionable techniques, real-world case studies, step-by-step walkthroughs, and command-line examples using industry-standard tools. Whether you are a student entering the field, a security professional expanding your skill set, or an experienced investigator looking for current best practices, this book delivers practical knowledge you can apply immediately in the lab, in incident response, and in court.

Author

About the Author

Steve Publications

Steve is a technology professional with more than 20 years of experience in software development, server infrastructure, cybersecurity, vulnerability research and reverse engineering. Throughout his career, he has designed, secured, analyzed and tested complex software and infrastructure, with a particular focus on understanding how systems fail and how they can be made more secure.

Outside of work, Steve enjoys sharing knowledge with the technology community. He collaborates with researchers, industry experts and technology professionals to write practical books covering software development, cybersecurity, cloud computing, networking, DevOps, artificial intelligence and enterprise technologies. His books focus on practical learning through clear explanations, real-world examples and hands-on exercises. With more than two decades of industry experience, his goal is to help IT professionals, students and technology enthusiasts build useful skills and stay current in a rapidly changing industry.

We believe readers deserve to know how our books are created. Most of our authors are not native English speakers, so we use AI to help translate, proofread manuscripts, fix grammar, improve sentence structure and make technical explanations easier to read. AI is used as an editing tool only. It does not replace the research, technical knowledge or hands-on experience behind our books. Some of our authors also prefer to remain anonymous for privacy or professional reasons. In those cases, we publish their work under a different name. The author's name may be different, but the quality of the content and our review process remain the same.

Every book is written, reviewed and maintained by experienced technology professionals, with contributions from our private technical community of more than 420 engineers and researchers. We spend far more time validating technical accuracy and keeping our content up to date than generating text. We are always interested in working with experienced professionals who have deep expertise in a particular technology or domain. If you would like to publish a book with us or help review an existing manuscript, we'd love to hear from you. Send us a message describing your area of expertise. We are especially interested in niche technologies, specialized skills and emerging topics that are underrepresented in existing technical literature.

If you look through the contents of our books, you'll see practical examples, detailed explanations and material that is regularly updated. Our goal is to publish books that professionals can actually rely on, not low-effort AI-generated content. If you ever feel that one of our books does not meet that standard, Leanpub offers a 60-day money-back guarantee. Feel free to request a refund if you are not satisfied with your purchase.

Contents

Table of Contents

From Evidence Acquisition to Advanced Analysis

Introduction: The Digital Crime Scene

  1. Why This Book Exists
  2. How to Use This Book
  3. What You Will Need
  4. Tool Version Matrix
  5. Managing Tool Version Drift
  6. A Note on Ethics and Legality
  7. The Road Ahead
  8. Running Case Studies

Chapter 1: Foundations of Digital Forensics

  1. What Is Digital Forensics (and What It Is Not)
  2. The Four Pillars: Identification, Preservation, Analysis, Presentation
  3. A Brief History: From Enron to Modern Cybercrime
  4. The Investigator’s Mindset: Scientific Method Meets Detective Work
  5. Legal Foundations and Admissibility Standards
  6. Summary

Chapter 2: Evidence Handling and Chain of Custody

  1. Identifying Digital Evidence: Sources, Types, and Prioritization
  2. The Chain of Custody Framework
  3. The Evidence Acquisition Workflow
  4. Write Blockers: Hardware and Software Solutions
  5. Forensic Imaging: Bit-by-Bit Copies and Image Formats
  6. Hashing and Integrity Verification (MD5, SHA-1, SHA-256, BKA)
  7. Troubleshooting and Performance: Imaging Challenges
  8. Chain of Custody Field Checklist
  9. Summary

Chapter 3: File Systems and Operating System Artifacts

  1. NTFS Internals: MFT, USN Journal, $LogFile, and Alternate Data Streams
  2. ext4 Forensics: Inodes, Journals, and Extents
  3. APFS and HFS+: macOS File System Artifacts
  4. Deleted Files, Slack Space, and Unallocated Space Recovery
  5. Sleuth Kit and Autopsy: Command-Line File System Analysis
  6. Cross-Platform Artifact Comparison Matrix
  7. Summary

Chapter 4: Windows Forensic Artifacts

  1. Registry Hive Analysis: SAM, SOFTWARE, SYSTEM, and NTUSER.DAT
  2. Prefetch, ShimCache, Amcache, and ShellBags
  3. Event Log Forensics: EVTX Parsing and Key Event IDs
  4. LNK Files, Jump Lists, and Recent File Artifacts
  5. Windows Memory Artifacts and Dump Analysis Preparation
  6. Summary

Chapter 5: Linux and macOS Forensic Artifacts

  1. Shell History, Bash RC Files, and Cron Artifacts
  2. Package Manager Logs: APT, YUM, DNF, and Homebrew
  3. System Logs: syslog, journalctl, and auth.log Analysis
  4. macOS-Specific Artifacts: LaunchDaemons, Spotlight, and Time Machine
  5. Container and VM Forensics Considerations
  6. Summary

Chapter 6: Memory Forensics

  1. The Volatility Framework: Installation and Profile Management
  2. Process Tree Analysis and Hollowing Detection
  3. Network Connection Extraction from Memory
  4. Malware Artifact Discovery: Strings, DLLs, and Code Injection
  5. Rekall, MemProcFS, and Commercial Alternatives
  6. Troubleshooting and Performance: Volatility 3 Common Issues
  7. Summary
  8. Memory Acquisition Field Checklist

Chapter 7: Mobile Device Forensics

  1. Acquisition Methods: Physical, Logical, File System, and Cloud
  2. Open-Source iOS Extraction: libimobiledevice Sequential Workflow
  3. iOS Forensics: SQLite Databases, Keychain, and Backup Parsing
  4. Android Forensics: ADB, DDMS, and App Data Extraction
  5. Cellebrite UFED and Commercial Tool Ecosystems
  6. WhatsApp, Signal, and Encrypted Messaging Analysis
  7. Mobile Forensics Field Checklist
  8. Summary

Chapter 8: Network Forensics

  1. Packet Capture Fundamentals: tcpdump, Wireshark, and tshark
  2. Zeek (Bro) for Network Forensic Analysis
  3. Reconstructing Sessions: HTTP, DNS, SMTP, and TLS
  4. Network Timeline Reconstruction
  5. KAPE and Velociraptor for Remote Collection
  6. Summary

Chapter 9: Cloud and Email Forensics

  1. Cloud Forensics Challenges: Ephemeral Infrastructure and Shared Responsibility
  2. AWS, Azure, and GCP Artifact Collection
  3. Automated Cloud Log Ingestion and Analysis
  4. Email Header Analysis and Message Reconstruction
  5. Exchange, Gmail, and IMAP/POP3 Forensic Techniques
  6. Cloud Logging and SIEM Integration
  7. Summary

Chapter 10: Browser Artifacts and Application Forensics

  1. Chrome, Firefox, and Edge Artifact Analysis
  2. Browser History, Cookies, Cache, and IndexedDB
  3. Flash, Java, and Plugin Artifacts
  4. Office Document Metadata and Hidden Content
  5. Application-Specific Forensics: Discord, Slack, Teams
  6. Summary

Chapter 11: Malware Investigation and Incident Response

  1. Incident Response Frameworks: NIST, SANS, and ISO 27035
  2. Static Analysis: YARA Rules, Strings, and PE Header Examination
  3. Dynamic Analysis: Sandboxing and Network Monitoring
  4. Memory-Based Malware Detection Techniques
  5. Threat Hunting with Sigma Rules and Velociraptor
  6. Summary
  7. Incident Response Triage Checklist

Chapter 12: Timeline Reconstruction and Log Analysis

  1. Plaso (log2timeline) and SuperTimeline Construction
  2. MACB Times and File System Timestamps
  3. Multi-Source Correlation Techniques
  4. Bulk Extractor for Keyword and Pattern Extraction
  5. Automated Timeline Generation and Visualization
  6. Troubleshooting and Performance: Plaso at Scale
  7. Summary

Chapter 13: Anti-Forensics and Countermeasures

  1. Data Hiding Techniques: Steganography, Hidden Partitions, and Timestomping
  2. Wiping and Destruction Tools: DBAN, shred, and sdelete
  3. Anti-Forensics Detection Strategies
  4. Rootkits, Bootkits, and Firmware-Level Attacks
  5. Living-off-the-Land Binary (LOTL) Investigations
  6. Summary

Chapter 14: Forensic Reporting, Legal Issues, and Emerging Trends

  1. Writing Defensible Forensic Reports
  2. Annotated Sample Forensic Report
  3. Expert Testimony and Cross-Examination Preparation
  4. Privacy Laws, GDPR, and International Jurisdiction
  5. AI-Assisted Investigations: Machine Learning in Forensics
  6. AI Admissibility: Current Legal Standards and Validation Requirements
  7. The Future: Quantum Computing, IoT, and Next-Generation Challenges
  8. Summary

Conclusion: The Investigator’s Path Forward

References

Get the free sample chapters

Click the buttons to get the free sample in PDF or EPUB, or read the sample online here

The Leanpub 60 Day 100% Happiness Guarantee

Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.

See full terms...

Earn $8 on a $10 Purchase, and $16 on a $20 Purchase

We pay 80% royalties on purchases of $7.99 or more, and 80% royalties minus a 50 cent flat fee on purchases between $0.99 and $7.98. You earn $8 on a $10 sale, and $16 on a $20 sale. So, if we sell 5000 non-refunded copies of your book for $20, you'll earn $80,000.

(Yes, some authors have already earned much more than that on Leanpub.)

In fact, authors have earned over $15 million writing, publishing and selling on Leanpub.

Learn more about writing on Leanpub

Free Updates. DRM Free.

If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).

Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.

Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.

Learn more about Leanpub's ebook formats and where to read them

Write and Publish on Leanpub

You can use Leanpub to easily write, publish and sell in-progress and completed ebooks and online courses!

Leanpub is a powerful platform for serious authors, combining a simple, elegant writing and publishing workflow with a store focused on selling in-progress ebooks.

Leanpub is a magical typewriter for authors: just write in plain text, and to publish your ebook, just click a button. (Or, if you are producing your ebook your own way, you can even upload your own PDF and/or EPUB files and then publish with one click!) It really is that easy.

Learn more about writing on Leanpub