Digital Forensic Computing Analysis
Computer Forensics Investigation Process
Understand the Forensic Investigation
Process and its Importance
Forensic Investigation Process
Forensic Investigation Process (Cont’d)
Forensic Investigation Process (Cont’d)
Importance of the Forensic Investigation Process
Understand the Pre-investigation
Phase
Setting Up a Computer Forensics Lab
Building the Investigation Team
Understanding the Hardware and Software
Requirements of a Forensic Lab
Validating Laboratory Software and Hardware
Ensuring Quality Assurance
Understand First Response
First Response Basics
First Response by Non-forensics Staff
First Response by System/Network Administrators
First Response by Laboratory Forensics Staff
Understand the Investigation
Phase
Computer Forensics Investigation Methodology -
Documenting the Electronic Crime Scene
Documentin the Electronic Crime Scene
Photographing and Sketching the Scene
Computer Forensics Investigation Methodology -
Search and Seizure
Search and Seizure Process Flow
Planning the Search and Seizure
Seeking Consent
Obtaining Witness Signatures
Obtaining Warrant for Search and Seizure
Example of a Search Warrant
Searches Without a Warrant
Collecting Incident Information
Collecting Incident Information (Cont'd)
Initial Search of the Scene
Securing and Evaluating the Crime Scene: A Checklist
Seizing Evidence at the Crime Scene
Dealing with Powered-On Computers
Dealing with Powered-On Computers (Cont'd)
Dealing with Powered-On Computers (Cont'd)
Dealing with Powered-Off Computers
Dealing with Networked Computers
Dealing with Open Files and Startup Files
Operating System Shutdown Procedure
Dealing with Smartphones or Other Handheld
Devices
Computer Forensics Investigation Methodology -
Evidence Preservation
Preserving Evidence
Chain of Custody
Simple Format of the Chain of Custody Document
Chain of Custody Form
Chain of Custody Form (Cont'd)
Chain of Custody on Property Evidence
Envelope/Bag and Sign-out Sheet
Evidence Bag Contents List
Packaging Evidence
Exhibit Numbering
Determining the Location for Evidence Examination
Transporting and Storing Evidence
Computer Forensics Investigation Methodology -
Data Acquisition
Acquiring the Data
Duplicating the Data (Imaging)
Computer Forensics Investigation Methodology -
Data Analysis
Analyzing the Data
Computer Forensics Investigation Methodology -
Case Analysis
Analysis of the Case
Evidence Reconstruction
Evidence Reconstruction
Significant ways in which evidence reconstruction can help the investigation process:
Collecting Evidence from Social Networks
Collecting Evidence from Social Networks (Cont'd)
Understand the Post-investigation
Phase
Computer Forensics Investigation Methodology -
Reporting
Gathering and Organizing Information
Writing the Investigation Report
Forensics Investigation Report Template
Guidelines for Writing a Report
Computer Forensics Investigation Methodology -
Testifying as an Expert Witness
Who is an Expert Witness?
Roles of an Expert Witness
What Makes a Good Expert Witness?
Testifying in the Court
General Ethics while Testifying