Importance of Computer Forensics Process

Phases Involved in the Computer Forensics Investigation Process

Pre-investigation Phase

1. Setting Up a Computer Forensics Lab

2. Planning and Budgeting

3. Physical Location and Structural Design Considerations

4. Work Area Considerations

5. Physical Security Recommendations

6. Fire-Suppression Systems

7. Evidence Locker Recommendations

8. Auditing the Security of a Forensics Lab

9. Human Resource Considerations

10. Build a Forensics Workstation

11. Basic Workstation Requirements in a Forensics Lab

12. Build a Computer Forensics Toolkit

13. Forensics Hardware

14. Forensics Software (Cont’d)

15. Build the Investigation Team

16. Forensic Practitioner Certification and Licensing

17. Review Policies and Laws

18. Forensics Laws

19. Establish Quality Assurance Processes

20. Quality Assurance Practices in Digital Forensics

21. General Quality Assurance in the Digital Forensic Process

22. Quality Assurance Practices: Laboratory Software and Hardware

23. Laboratory Accreditation Programs

24. Data Destruction Industry Standards

25. Risk Assessment

26. Risk Assessment Matrix

Investigation Phase

1. Investigation Process

   • Questions to Ask When a Client Calls the Forensic Investigator

   • Checklist to Prepare for a Computer Forensics Investigation

   • Notify Decision Makers and Acquire Authorization

2. Computer Forensics Investigation Methodology: First Response

   • First Responder

     • Roles of First Responder

   • First Response Basics

   • Incident Response: Different Situations

     • First Response by System Administrators

     • First Response by Non-Forensic Staff

     • First Response by Laboratory Forensic Staff

   • First Responder Common Mistakes

   • Documenting the Electronic Crime Scene

     • Photographing the Scene

     • Sketching the Scene

     • Note Taking Checklist

3. Computer Forensics Investigation Methodology: Search and Seizure

   • Consent

     1. Sample of Consent Search Form

     2. Witness Signatures

     3. Witness Statement Checklist

   • Conducting Preliminary Interviews

   • Planning the Search and Seizure

     1. Obtain Search Warrant

     2. Example of Search Warrant

   • Initial Search of the Scene

   • Warrant for Search and Seizure

   • Searches Without a Warrant

   • Health and Safety Issues

   • Securing and Evaluating Electronic Crime Scene: A Checklist

4. Computer Forensics Investigation Methodology: Collect the Evidence

   • Collect Physical Evidence

     1. Evidence Collection Form

   • Collecting and Preserving Electronic Evidence

   • Dealing with Powered on Computers

   • Dealing with Powered Off Computers

   • Dealing with Networked Computer

   • Dealing with Open Files and Startup Files

   • Operating System Shutdown Procedure

   • Computers and Servers

   • Preserving Electronic Evidence

   • Seizing Portable Computers

   • Dealing with Switched on Portable Computers

5. Computer Forensics Investigation Methodology: Secure the Evidence

   • Evidence Management

   • Chain of Custody

     1. Simple Format of the Chain of Custody Document

     2. Chain of Custody Forms

     3. Chain of Custody on Property Evidence Envelope/Bag and Sign-out Sheet

   • Packaging and Transporting Electronic Evidence

     1. Evidence Bag Contents List

     2. Packaging, Electronic Evidence

     3. Exhibit Numbering

     4. Transporting Electronic Evidence

   • Storing Electronic Evidence

6. Computer Forensics Investigation Methodology: Data Acquisition

   • Guidelines for Acquiring Evidence

   • Duplicate the Data (Imaging)

   • Verify Image Integrity

     1. MD5 Hash Calculators: HashCalc, MD5 Calculator and HashMyFiles

   • Recover Lost or Deleted Data

     1. Data Recovery Software

7. Computer Forensics Investigation Methodology: Data Analysis

   • Data Analysis

Post-investigation Phase

Computer Forensics Investigation Methodology: Evidence Assessment

1. Evidence Assessment

2. Case Assessment

3. Processing Location Assessment

4. Collecting Evidence from Social Networks

5. Best Practices on how to Behave as an Investigator on Social Media

6. Best Practices to Assess the Evidence

Computer Forensics Investigation Methodology: Documentation and Reporting

1. Documentation in Each Phase

2. Gather and Organize Information

3. Writing the Investigation Report

Computer Forensics Investigation Methodology: Testify as an Expert Witness

1. Expert Witness

2. Testifying in the Court Room

3. Closing the Case

4. Maintaining Professional Conduct