Title: 9. Reviewing a Case
Course: IN 2005 Digital Forensics > Section: Module 5: Chapter 5 - Processing Crime and Incident Scenes

Reviewing a Case

1. This section describes the following general tasks you perform in any computer forensics case:
  - Identify the case requirements
  - Plan your investigation
  - Conduct the investigation
  - Complete the case report
  - Critique the case

Identifying the Case Requirements

1. Start by identifying the case requirements, such as:
  - Nature of the case
  - Suspect’s name
  - Suspect’s activity
  - Suspect’s hardware and software specifications

Planning the Investigation

1. During this phase, you must list what you can assume or know, including:
  - Whether several incidents may or may not be related
  - Whether suspect’s computer can contain information about the case
  - Whether someone else has used suspect’s computer
2. In addition, you should make an image of the suspect’s computer disk drive and analyze the forensics copy.