Explain like I'm five · Security

What is Digital Forensics?

Digital forensics, told as a story about setting a thief's footprint in plaster and keeping it in a glass box.

an open chest and footprintsI'll sweep it all up!sweep it away, and we never learn how he got in

The morning after a thief. Footprints lead to the chest.The maid wants to tidy up. But sweep the footprints away, and we never learn how he got in.

our own prints cover histhe log gets touched upis this even real?nobody believes ita footprint once disturbed can never be made again

Touch it wrong and three things break: it gets covered, it gets edited, and nobody believes it.Our own prints cover the thief's. Touch the log, and someone asks "didn't you edit that?" Once disturbed, it can never be made again.

set it as it iswho·whenglass box + fingerprint + taglook, never touchset it, fingerprint it, tag itnobody touches the real print — we study a copy

Digital forensics is setting the footprint as it is, and keeping it.Set it, fingerprint it, tag it. Nobody touches the real print — what we study is a copy.

Set it as it isa copy, not a grain changed
Fingerprint itchange anything, the print changes
Tag itwho touched it, and when
String it on the clockthe order is the story
THE THIEF'S NIGHT, IN ORDER11 pmfake letter11:30 pmhall footprintsmidnightchest opened12:20 amout the back doorevery print, strung on the clock in orderthe candle-like things first — then it becomes a story

Every print gets strung on the clock, in order.The fake letter, the hall prints, the open chest, the back door. Set the candle-like things first — the ones that fade fast. Strung together, it becomes a story.

who·whenas evidence in courtLEARNwhere: west windowwhat: one roster pagenext: lock the windowthe book's last steponly an untouched print works in court — and in the lesson

The set print serves in court — and in the lesson.The king believes it only if the tag chain is unbroken. And the last step of the book, "learn", is filled from this print. Setting it takes time — and by then, the thief is long gone.

In one breath

Digital forensics = set the thief's prints and logs as they are (a copy), fingerprint and tag them, and string them on the clock into a story — for court, and for the lesson.

Imaging disks, memory, and logs without alteration, proving integrity with hashes, recording chain of custody, then reconstructing a timeline. Used as legal evidence and to draw lessons in incident response.

When grown-ups say it

Forensics
Setting and keeping the print. Keeping what the thief left untouched, and reading it in order.
Evidence preservation
Putting the broom away. Set it before anyone sweeps. The prints → the footprint left behind
Disk image
The copy set in plaster. The whole chest, copied without changing a grain. This copy is what gets studied.
Hash
The fingerprint. Stamp a fingerprint on the set copy, and any change shows at once. → a fingerprint on everything
Chain of custody
The who·when tag. Who received it when, and handed it to whom, with no gaps. One blank, and the king won't believe it.
Timeline
Stringing it on the clock. Prints, logs, and letters in time order. → the one-line log everywhere
Memory forensics
The candle first. Some things vanish when the flame goes out. Set those before the chest.
Incident response
The book's last step. The set print fills in "learn". → the book for when a thief gets in
Next story
A Number Instead of a Name →
Want another term as a picture book? Request →