websec.gr
DIGITAL FORENSICS / THE DISCIPLINE
Acquire carefully. Verify integrity. Correlate the artifacts. Explain what the evidence supports — and where it stops.
METHOD BEFORE CONCLUSIONS
An artifact is a starting point. Its origin, timestamps, surrounding records and collection history give it meaning. A defensible investigation keeps those relationships intact.
Our research connects storage and device evidence with network context, evidence integrity and incident reconstruction. The emphasis is on a clear method and findings that another analyst can examine.
Read the original forensic research ↗
LOOK BEYOND THE SURFACE
The device is the beginning. A defensible finding connects the source, its artifacts and the limits of what they can tell us.
Document the source and the collection boundary.
Keep integrity checks and the handling record together.
Correlate artifacts. Test alternative explanations.
FROM SOURCE TO FINDING
01 / ACQUISITION & PRESERVATION
Define the collection scope and record the condition of the source. Choose an acquisition method suited to the device, its state and the evidence sought. Keep original media separate from analysis and document every transfer.
Imaging & chain of custody ↗02 / INTEGRITY & PROVENANCE
Record acquisition details, tool versions, identifiers and verification hashes. A matching hash supports byte-level consistency; the handling record explains where the evidence came from and what happened to it.
Evidence integrity in practice ↗03 / ARTIFACTS & RECONSTRUCTION
Correlate filesystem metadata, application records, device artifacts and network observations. Account for clock differences, missing records and alternative explanations. Distinguish an observed event from an inferred action.
Incident response foundations ↗04 / FINDINGS & LIMITATIONS
Connect each finding to its supporting evidence. Explain the method, assumptions and uncertainty. Present a coherent timeline while keeping observations, interpretations and unresolved questions distinct.
Explore the forensic research ↗LEARN HOW TO LOOK CLOSER
Six selected videos. Five new field guides. Mobile evidence, computer timelines and a careful first look at suspicious files.
Enter the viewing room ↗KEEP INVESTIGATING
Explore the original field guides and research alongside the latest published articles. Digital forensics sits within a wider defensive practice: mobile hardening, private communications, containment and recovery all provide context.