Title: 1. Determining What Data to Collect and Analyze
Course: IN 2005 Digital Forensics > Section: Module 9: Chapter 9 - Computer Forensics Analysis and Validation

Determining What Data to Collect and Analyze

1. Some of the factors that can shape the way digital evidence is examined or analyzed both on private and public sectors, including:
  - Nature of the case
  - Amount of data to process
  - Search warrants
  - Court orders
  - Company policies

Approaching Computer Forensics Cases

1. Although there are some basic principles that apply to almost all computer forensics cases, the approach you take depends largely on the specific type of case you’re investigating.
2. Some of the basic steps for all computer forensics investigations, including:
  - For target drives, use only recently wiped media that have been reformatted and inspected for computer viruses
  - Inventory the hardware on the suspect’s computer and note the condition of the computer when seized
  - Remove the original drive from the computer and then check the date and time values in the system’s CMOS
  - Record how you acquired data from the suspect drive
  - Process the data methodically and logically
  - List all folders and files on the image or drive
  - If possible, examine the contents of all data files in all folders, starting at the root directory of the volume partition
  - For all password-protected files that might be related to the investigation, make your best effort to recover file contents
  - Identify the function of every executable (binary or .exe) file that doesn’t match known hash values
  - Maintain control of all evidence and findings and document everything as you progress through your examination

Refining and Modifying the Investigation Plan

1. Some of the considerations to refine an investigation plan:
  - Determine the scope of the investigation
  - Estimate number of hours to complete the case
  - Whether you should collect all information
  - What to do in case of scope creep
2. The key is to start with a plan but remain flexible in the face of new evidence.