When most people think about digital forensics they envisage the type of world portrayed by shows like CSI Cyber, but the reality is very different. While these shows do not always accurately depict digital forensics, they have at least increased the interest in forensic science. In this webcast we will explore the various forensic science principles that underpin the practice of digital forensics, and how to use these principles to find and better present digital evidence in your investigations, so you can answer the questions you need answers to more accurately. To illustrate these principles, we will show how the FOR500 course contents leverages of them to allow us to reconstruct activity on Windows computer systems.