6

I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?

6

It might be said that the goals (motive) of the investigation rather than the tools or techniques determine whether some work would be classified as digital forensics or reversing.

Definitionally digital forensics is the examination and analysis of digital evidence for use in a legal proceeding. It is certainly true that not all DF is for legal cases, but that is what forensics means :)

Reverse engineering is the process of , well, reversing someone else's engineering. There are plenty of reasons to use RE techniques that don't have anything to do with legal investigations, including reversing to gain and maintain compatibility or purely for education and knowledge.

Decompilation/disassembly, debugging, and reading code/assembly, are all techniques that can be used in DF (DFIR), development and testing of software and hardware, as well as RE.

  • Missing a very important difference in the approach itself. In forensics one has to be very careful not to change anything, whereas in RCE "anything goes". – 0xC0000022L Aug 19 '13 at 11:01
  • Thanks for commenting. Although I agree much more could be said about the forensic perspective differing from that of RE I don't agree with either of your suggestions. I would say that desired outcome dictates techniques in both fields. Most forensics processes take great care to be reproducible and not to destroy evidence. I think the same is true in a very different way of RE. – adric Aug 19 '13 at 15:15
3

At a very high level...

Reverse engineering typically focuses on recovering the functional specifications of code.

Digital forensics typically focuses on recovering data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.