Digital Forensics Services: What Investigators Are Hired to Do
Skill packs and prompts are provided in English so they work best with the AI tools. Use them as-is.
Where you are: Part III — DFIR, Services and Techniques · Lesson 3.3 · This lesson follows Chapter 4 of Dr. Al-Doori's IT Forensics Essentials (digital forensics services), together with the types of digital forensics in Chapter 3.1.
What you'll be able to do
By the end of this lesson you will be able to match a real problem to the right kind of forensic service.
- Describe the twelve digital forensics services in the book and what each one delivers.
- Group the services by what they examine: devices, networks and the cloud, communications, incidents and business, and the courtroom.
- Recognize the legal limits that shape mobile, cloud and social media work.
Why Think in Services?
Chapter 4 presents digital forensics from the client's point of view: the specialized services investigators provide in criminal investigations, corporate investigations and personal matters. Thinking in services helps you answer the first practical question in any case: what kind of expertise does this problem need? The book lists twelve. They are grouped below by what they examine.
Devices
- Computer forensics. Investigating computers and storage devices (hard drives and SSDs) for evidence of crime or policy violations: recovering deleted, corrupted or damaged files, examining system logs and application data, identifying malware or unauthorized access, and using file metadata to build timelines.
- Mobile device forensics. Investigating smartphones and tablets: extracting call logs, messages, contacts and app data; recovering deleted photos and emails; analyzing GPS and location history; and bypassing locks such as PINs and passwords, where legally authorized.
- Forensic imaging and evidence preservation. Creating bit-for-bit images of drives and devices, keeping the chain of custody, using write-blockers and preserving evidence to legal standards. This is the foundation that every other service relies on.
- Digital evidence recovery. Recovering data from damaged devices, including fire- and water-damaged hardware and formatted, corrupted or encrypted drives, often with specialized equipment.
Networks and the Cloud
- Network forensics. Capturing and analyzing network packets and data flows to investigate intrusions, distributed denial-of-service (DDoS) attacks and data exfiltration, and reviewing logs and intrusion detection alerts.
- Cloud forensics. Investigating data in cloud services such as Google Drive, Dropbox and Amazon Web Services: account activity, logs, authentication records and data-access history, all handled with proper legal compliance on a third party's platform.
Communications and People
- Email forensics. Recovering deleted emails, analyzing headers to trace where messages came from and went, detecting spoofing and phishing, and examining attachments and links. Lesson 3.7 shows how to read a header.
- Social media forensics. Investigating posts, messages and interactions; recovering deleted or hidden content; analyzing geolocation and metadata; and identifying fake or fraudulent accounts.
Incidents and Business
- Data breach and incident response. Identifying the source and scope of a breach, how attackers got in and what data may be compromised, preserving evidence for legal or regulatory needs and reporting on the timeline.
- Forensic data analytics. Analyzing large data sets for fraud, such as credit card fraud and money laundering, and using algorithms to find anomalies and hidden connections in transactions and communications.
- Cyber security consulting and vulnerability assessment. Penetration testing, assessing defenses, monitoring for threats and advising on compliance with regulations such as GDPR (the EU's data protection law) and HIPAA (US health privacy law).
The Courtroom
- Expert witness services. Testifying about how evidence was collected, preserved and analyzed, helping lawyers understand the technical details, and explaining findings clearly to a non-technical audience. Part VI is devoted to this.
Real-World Example
Imagine (a fictional scenario) a secondary school where a student is targeted by an anonymous social media account posting embarrassing photos taken from a group chat. The family, the school and later the police each need different services.
- Social media forensics documents the posts, their metadata and the account's activity, preserved with timestamps.
- Because the platform holds the account records, police use legal process to the provider to obtain sign-in records, rather than trying to "recover" them from the platform themselves.
- Those records lead to an IP address used by a home connection. A warrant allows mobile device forensics on a classmate's phone, which shows the photos being saved from a group chat and the anonymous account being used.
- An examiner provides expert witness evidence when the case reaches court.
No single service solved it. Each did one part, in the right legal order.
From the Book to 2026
What the book teaches. Twelve services, from computer and mobile forensics to cloud, email, social media and expert witness work, used in criminal, corporate, civil and personal matters.
Why it made sense. It is a complete map of the market, and the services remain the same today.
What has changed. The balance has shifted toward mobile and cloud. NIST describes cloud forensics as raising challenges that traditional forensics does not face, because the data sits on a provider's systems, is shared among many customers and may be spread across countries. In practice, investigators obtain most cloud and social media records through legal requests to the provider, or with the account owner's authorization, rather than by extracting them directly. Encryption and lock protections on phones mean that "bypassing locks" is now specialist work, done only by trained people with specific legal authority. Some names have changed too: Twitter is now X.
What to do now. In every case, ask first where the data physically lives and who controls it: the device owner, the organization or a provider. That tells you which service you need, and which legal route.
Watch: Mobile Device Forensics, Collection and Preservation
This video from the Texas Department of Public Safety, a US state law-enforcement agency, covers the collection and preservation of mobile devices as evidence.
Questions to keep in mind as you watch:
- What steps are taken to protect a phone from being changed or erased after it is seized?
- How does the advice connect with Lesson 1.3's warning about guessing passcodes?
- Which of the book's mobile forensics services depend on the phone being preserved correctly at this first stage?
The video complements what you just read. The lesson is complete without it. For an optional introduction to network forensics tools, see the further-study link on this lesson.
What Would You Do?
A company discovers that a former manager may have taken customer data. The data was stored in a cloud file-sharing service the company pays for, and the manager used both a company laptop and a personal phone. Which forensic services would you recommend, and which source would you be careful with? Decide, then compare with the model answer in the note below.
Knowledge Check
A company needs to know whether a contractor's emails were spoofed to trick its finance team. Which service fits best?
Which service does the book describe as recovering data from fire- or water-damaged devices?
Why do investigators usually obtain cloud and social media records through legal requests to the provider?
Answers explained
- Question 1: b. Header analysis and spoofing detection are email forensics.
- Question 2: a. Damaged-media recovery is digital evidence recovery.
- Question 3: a. The provider controls the systems, which are shared and may be in other jurisdictions. Cloud data is very often used as evidence (b), and options c and d are false generalizations.
On "What Would You Do?": Recommend cloud forensics on the company's own cloud tenant, whose audit and access logs the company can lawfully review as the account owner; computer forensics on the company laptop, with forensic imaging and preservation first; and possibly data breach services for notification decisions. Be careful with the personal phone: the company does not own it, so examining it needs the manager's consent or a court order. Get legal advice before going near it.
Key Takeaways
- The book lists twelve services: computer, mobile, network, cloud, breach response, imaging and preservation, email, evidence recovery, data analytics, consulting, expert witness and social media.
- Group them by what they examine: devices, networks and cloud, communications, incidents and business, and the courtroom.
- Imaging and preservation underpin every other service.
- Mobile, cloud and social media work is shaped by encryption, providers and legal process. Ask where the data lives and who controls it.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapters 3.1 and 4
- NIST — IR 8006: NIST Cloud Computing Forensic Science Challenges
- NIST — SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
- US Department of Justice — CLOUD Act resources
- EUR-Lex — Regulation (EU) 2016/679 (General Data Protection Regulation)