Electronic evidence
Information stored in digital form that may have probative value. Examples: files, logs, memory dumps, network traffic.
01 — Introduction
About digital forensics
A discipline at the intersection of technology, law and investigative methodology. Its goal — to turn invisible digital traces into evidence that survives in court.
Digital forensics is an applied science whose purpose is to identify, preserve, collect, examine and present electronic evidence in a way that makes it admissible in court.
Cybercrime covers acts committed using or against information technologies. Digital traces never disappear — they only wait to be collected correctly.
- Evidence integrity (hash, write-blocker)
- Chain-of-custody documentation
- Repeatability principle: the investigation must be verifiable
- Lawfulness principle: collection under the Lithuanian Code of Criminal Procedure
02 — Concepts
Concept glossary
Terms no cybercrime investigation can do without.
Chain of Custody
The evidence movement chain — who, when, where and on what grounds contacted the evidence. Any gap = loss of evidence.
Hash function
MD5, SHA-1, SHA-256 — cryptographic „fingerprint" function proving the evidence was not altered during the investigation.
Write-blocker
A hardware or software blocker that physically prevents writes to the original media — a mandatory condition for imaging.
IOC — Indicator of Compromise
A compromise marker: malicious file hash, C2 IP/domain, registry key, unusual process. STIX/TAXII formats.
DFIR
Digital Forensics & Incident Response — a combined investigation and incident-management process where speed and evidence quality matter equally.
OSINT
Open Source Intelligence — reconnaissance from publicly available sources: domains, social networks, code repositories, leaked databases.
TTP & ATT&CK
Tactics, techniques, procedures — the MITRE ATT&CK catalog provides a threat map that links attacks to groups.
LT CCP Art. 158, 160
Procedural rules governing the seizure, examination and analysis of electronic data. The foundation without which evidence fails in court.
03 — Core principles
Five principles
Criteria by which every investigation stage is measured.
1. Integrity
Evidence must not change during the investigation. Verified by hash before and after.
2. Authenticity
It can be proven that the evidence is the same as the one collected at the scene.
3. Reliability
Recognised tools and methods are used and the results can be reproduced.
4. Repeatability
Another expert, given the same data, must reach the same conclusions.
5. Proportionality
The collection scope is adequate for the investigation — without excessive collection of personal data.
6. Transparency
All actions are documented — from seizure to conclusion. No black boxes.