Learn in the textbookSecurity Testing and IoT / Hardware Protection
DefinitionDigital forensics (デジタルフォレンジックス) is the umbrella term for techniques and procedures that collect records left on computers as evidence, preserve them and analyze them after an incident such as unauthorized access or a data leak.
ExplanationIf you cannot show that the collected data was left unaltered, a court is unlikely to accept it as evidence. The standard practice is therefore to keep the originals as they are and work on copies.
AnalogyThe digital version of crime-scene investigators wearing gloves so they do not smudge fingerprints, then taking the evidence back to the lab.
Memory hookForensic means "relating to courts of law," the same word as in forensic medicine. Think of it as handling evidence meant for court.