Information Technology and Digital Forensics
Preserve, then examine
Digital evidence is fragile. Follow the forensic process: identification, preservation, acquisition, examination, analysis and reporting. Capture volatile data in order of volatility - registers and cache, RAM and running processes, network connections, then disk. Acquire a bit-stream image through a write blocker so the original is never altered, and compute a cryptographic hash (SHA-256 or MD5) at acquisition and again at analysis to demonstrate integrity. Maintain chain of custody for every device, image and storage medium.
In IT audit, distinguish general controls (access management, change management, backup, physical security) from application controls (input, processing, output). Segregation of duties in ERP is a core fraud theme: one user must not be able to create a vendor, approve an invoice and release payment. CAATs (ACL, IDEA), audit logs, SIEM alerting, continuous auditing and data analytics detect anomalies such as duplicate payments, round-sum amounts, payments to employees' own bank accounts and after-hours journal entries.
Traps: believing a hash encrypts data (it only verifies integrity); assuming deleted files are unrecoverable; copying files by drag-and-drop instead of imaging, which alters metadata; powering down a machine before capturing RAM; ignoring jurisdiction where evidence sits in the cloud.
Rule of thumb: if you cannot show the hash matched, you cannot show the evidence is unaltered.
Worked example: a suspected insider data leak. Capture RAM and volatile logs, image the laptop, hash the image, then analyse email and USB connection logs. The hash report becomes the exhibit proving the working copy is a true copy of the original.