Areas of investigation.

Research into forensic artifacts produced by operating systems, applications, devices, and user activity.

Studies may examine where artifacts originate, what information they contain, how they change over time, and which traces remain after modification, deletion, synchronization, or system changes.

Research considers the conditions under which an artifact appears, changes, disappears, or remains available for forensic examination.

Research examining how digital information moves through different states from creation and storage to synchronization, modification, deletion, recovery, and retention.

Studies may compare how the same information is represented across devices, applications, file systems, cloud services, and other digital environments.

Particular attention is given to transitions between systems and the changes that occur as information moves between them.

Investigation of newer platforms, applications, devices, services, and technologies whose forensic characteristics are still developing.

Research may document previously uncharacterized artifacts, behaviors, storage mechanisms, synchronization patterns, and other technical traces.

Early examination can establish a documented baseline for how new technologies behave before their forensic characteristics become broadly understood.

Development and evaluation of repeatable approaches for examining digital artifacts and evidence behavior.

Experiments may define the system environment, inputs, user actions, acquisition conditions, analytical methods, and expected observations before testing begins.

Findings are documented alongside relevant limitations and uncertainties so that observations can be evaluated, reproduced, and compared across experiments.