I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
asked Aug 17, 2013 at 14:15
Add a comment
|
2 Answers
It might be said that the goals (motive) of the investigation rather than the tools or techniques determine whether some work would be classified as digital forensics or reversing.
Definitionally digital forensics is the examination and analysis of digital evidence for use in a legal proceeding. It is certainly true that not all DF is for legal cases, but that is what forensics means :)
Reverse engineering is the process of , well, reversing someone else's engineering. There are plenty of reasons to use RE techniques that don't have anything to do with legal investigations, including reversing to gain and maintain compatibility or purely for education and knowledge.
Decompilation/disassembly, debugging, and reading code/assembly, are all techniques that can be used in DF (DFIR), development and testing of software and hardware, as well as RE.
-
Missing a very important difference in the approach itself. In forensics one has to be very careful not to change anything, whereas in RCE "anything goes".– 0xC0000022L ♦Aug 19, 2013 at 11:01
-
Thanks for commenting. Although I agree much more could be said about the forensic perspective differing from that of RE I don't agree with either of your suggestions. I would say that desired outcome dictates techniques in both fields. Most forensics processes take great care to be reproducible and not to destroy evidence. I think the same is true in a very different way of RE.– adricAug 19, 2013 at 15:15
At a very high level...
Reverse engineering typically focuses on recovering the functional specifications of code.
Digital forensics typically focuses on recovering data.
answered Aug 18, 2013 at 22:16
