Digital forensics is crucial to cybercrime investigations and legal actions, and this chapter gives a full introduction. Students study evidence integrity, chain of custody, and admissibility. The chapter covers forensic identification, preservation, collecting, examination, analysis, and reporting. Digital evidence from devices, networks, and storage media is shown in real-world examples. Disk imaging, data carving, file system analysis, and volatile memory acquisition are covered. Network and mobile device forensics provide insights into traffic capture and deleted material recovery. Data handling must comply with the Fourth Amendment, GDPR, and corporate policy, according to the chapter. Investigating incident response integration shows how forensics aids containment and recovery. Students learn to conduct digital investigations and preserve digital evidence legally and technically through a balance of theory and hands-on relevance.