Digital Forensics: Concepts, Techniques, and their Role in Cybercrime Investigation

Digital forensics has become a core component of contemporary cybercrime investigations. It supports investigators in locating, acquiring, examining, and explaining digital traces in a form that legal and regulatory systems can accept. Yet the literature is often fragmented: conceptual studies emphasize definitions and process models, technical surveys tend to focus on particular tools or subdomains, and case reports concentrate on specific incident types. This paper offers an integrated perspective on digital forensic concepts, methods, and applications with a deliberate focus on cybercrime investigations. We first consolidate foundational notions such as the characteristics of digital evidence, chain of custody, and widely used forensic process models as reflected in international standards and professional guidelines. We then review methods and tools across key subfields disk, memory, network, mobile, cloud, and IoT forensics highlighting recent progress in automation and AI/ML based support. On this basis, we introduce a three-layer conceptual framework that connects (1) foundational concepts, (2) methods and tools, and (3) investigative applications, and we demonstrate its use through representative cybercrime scenarios including data breaches, insider data theft, crypto-enabled financial crime, and online child sexual exploitation. Finally, we discuss cross-cutting issues such as encryption, anti-forensics, scale, and jurisdiction, and sketch a research agenda centered on AI driven workflows, cloud and IoT environments, standardization, and human capacity building. The contribution is positioned as a "survey-plus-framework" resource for researchers and practitioners seeking a coherent map of the digital forensics landscape in cybercrime investigations.