Acquisition
Jul 16, 2026
Digital Forensics Acquisition Documentation
A practical guide to recording forensic sources, destinations, methods, tools, versions, write protection, timestamps, hashes, errors, and outputs.
10 minutes
Read guide →
ByteCase Guide Hub
Practical explanations without the unnecessary complexity.
Original ByteCase explanations, checklists, and practical references for digital forensic examiners, technical reviewers, and people learning core technical concepts.
Browse by category
Start with the problem you are trying to understand.
3 guides
Integrity and Hashing
Hashes, manifests, re-verification, comparison results, and integrity records.
Open category → 1 guideAcquisition
Source, destination, method, tooling, integrity, errors, and acquisition documentation.
Open category → 1 guideIntake
Request scope, authority references, devices, accounts, urgency, and examiner handoff.
Open category → 1 guideValidation
Known-value testing, expected results, limitations, environments, and revalidation.
Open category → 1 guideWorkflow
Case folders, repeatable processes, workflow states, handoff, and closeout.
Open category → 1 guideDocumentation
Examiner actions, observations, interpretations, sources, and report preparation.
Open category → 2 guidesDatabase Fundamentals
SQLite, relational data, SQL, NoSQL models, and database artifacts.
Open category →All guides
Newest writing first.
Workflow
Jul 9, 2026
Digital Forensics Case Folder Structure
A practical local folder model for keeping intake, acquisition, verification, examiner notes, timelines, exhibits, reports, and supporting records predictable.
8 minutes
Read guide →
Intake
Jul 9, 2026
Digital Forensics Request Intake Checklist
The information a forensic examiner should receive about the case, requestor, authority, scope, devices, accounts, urgency, credentials, and delivery needs.
9 minutes
Read guide →
Documentation
Jul 2, 2026
Digital Forensics Examiner Notes
A practical approach to recording examiner actions, observations, interpretations, questions, timestamps, tools, sources, screenshots, and report-ready facts.
10 minutes
Read guide →
Integrity and Hashing
Jul 2, 2026
Forensic Hash Verification
A practical explanation of file hashes, saved manifests, later re-verification, comparison results, and the limits of what a matching hash establishes.
9 minutes
Read guide →
Validation
Jul 2, 2026
Forensic Tool Validation
A plain-language guide to validation, verification, known-value testing, expected and observed results, versions, environments, limitations, and revalidation triggers.
12 minutes
Read guide →
Integrity and Hashing
Jul 2, 2026
What Is a Forensic Hash Manifest?
A straightforward guide to forensic hash manifests, the fields they should contain, how they differ from a single hash value, and why paths and metadata matter.
7 minutes
Read guide →
Integrity and Hashing
Jun 25, 2026
Understanding Hash Verification Results
How to interpret matching, changed, missing, new, inaccessible, skipped, path-changed, and error results during hash re-verification.
8 minutes
Read guide →
Database Fundamentals
Jun 18, 2026
Relational Databases, NoSQL, and Forensic Artifacts
A deeper guide to relational data models, normalization, joins, transactions, SQLite sidecar files, and document, key-value, wide-column, and graph databases.
18 minutes
Read guide →
Database Fundamentals
Jun 18, 2026
SQLite and Relational Databases: The Simple Explanation
A straightforward explanation of SQLite, tables, rows, columns, keys, relationships, SQL, and how relational databases differ from spreadsheets and NoSQL databases.
10 minutes
Read guide →
External references
Original guides are only one part of the library.
Return to the broader Resources page for NIST, SWGDE, SANS, practitioner projects, validation data, and recommended books.