J. M. Clark & Associates

Overview of Digital Forensics

Acquisition

Acquisition

• Is the process of collecting electronic Is data
• Example: seizing a computer at a crime scene or taking custody of a computer in a civil suit
• Making a forensically sound acquisition of a computer hard drive
• This is the point where evidence is most likely to be damaged or destroyed

Preservation

• It is the process of creating a chain of custody that begins prior to collection and ends with evidence is released to the owner or destroyed
• Preserved in state that is defendable in court
• Keeping it safe from intentional destruction or accidental modification
• Chain of custody log is critical

Analysis

• Is the process of locating and collecting evidentiary items from collected evidence
• Examples of evidence to be analysed: emails, chat logs, financial records, pictures, movies
• Is the area where the examiner has the greatest impact on the examination outcome
• More than determining whether evidence exists, it also includes how it got there and who put it there

Presentation

• Is the last step in the process of forensic analysis
• Includes written findings, creation affidavits, deposition of experts and court testimony
• Should include the collection methods used, steps taken to protect & preserve the original evidence and how the verification of the evidence was performed

J. M. Clark & Associates

Untitled Slide