Forensic describes work connected with legal questions, especially the examination and interpretation of evidence using specialist knowledge. It appears in terms such as forensic science, forensic accounting and digital forensics.
The NIST glossary defines forensic science as the application of science to law. The broader adjective also covers specialist financial and technical work for disputes or investigations. It does not mean that every forensic task happens in a laboratory.
Forensic and forensics
Forensic is usually an adjective: a forensic examination, a forensic accountant or a forensic report. Forensics is commonly used as a noun for investigative methods and related work.
The context matters. In business, a forensic accounting engagement may concern suspected fraud or the amount of an economic loss. A legal dispute does not have to involve a criminal prosecution.
What kinds of work does it include?
NIST’s forensic science program covers areas including genetics, toxicology, trace evidence and digital evidence. Specialists may examine materials, compare samples or interpret findings that help answer questions in an investigation. Their work can support a suspected explanation or help exclude an innocent person.
Digital forensics concerns evidence from devices and systems, including stored files and activity records. It is broader than pursuing people who break passwords. An investigation might concern a disputed document, a data breach or the sequence of business events.
AICPA’s forensic services resources include fraud investigations, economic damages, bankruptcy and family-law disputes. Forensic accountants may trace transactions or quantify a loss. Forensic engineers examine failures, while forensic medicine applies medical knowledge to legal questions.
An example from business records
Suppose a fictional company’s ledger contains two entries for the same $1,200 invoice. The entries add up to $2,400. That is a specific observation about the records.
It does not by itself show that $2,400 left the bank account, that the company suffered a $1,200 loss or that someone intended to defraud it. A duplicate posting, a reversed entry and two actual payments are different possibilities.
The forensic question is what the available evidence supports. The eventual explanation may depend on payment records, source documents and other context. The example illustrates the difference between identifying an anomaly and establishing its cause.
Why does evidence handling matter?
NIST describes evidence management as protecting material from compromise, contamination and degradation while tracking its chain of custody. Chain of custody is the documented history of who handled an item and how it moved between custodians.
Digital evidence has additional preservation issues, because information can be altered, lost or become inaccessible. Preserving data and documenting its handling helps make an examination open to scrutiny. It does not establish that everything in a file is true.
What can a forensic conclusion establish?
A conclusion depends on the method, quality of the material and question being asked. A qualified finding is more useful than claiming that science has proved every part of a case.
Forensic specialists explain results and relevant limitations. Courts decide how evidence may be used and assess it alongside the rest of a case. The label forensic is not a guarantee of accuracy, admissibility or guilt.
Last checked and updated on November 3, 2026 by the MBN editorial team.