Title: 6 Managing Investigations in the Organization
Course: IN 2005 Digital Forensics > Section: Module 12: Chapter 12 -E-mail Investigations

Managing Investigations in the Organization
1. Digital forensics (also known as e-discovery) which is the investigation of what happened and how, when a suspected policy or law violation has been discovered.
2. Digital forensics involves the preservation, identification, extraction, documentation and interpretation of computer media for evidentiary and/or root cause analysis.
3. Evidentiary material, which is any information that could potentially support the organization’s legal or policy-based case against a suspect.

The Digital Forensics Team
1. Most organizations cannot sustain a permanent digital forensics team, but use outsourcing to assign the analysis to a regional expert.
2. Organizations should have individuals who are trained in digital forensics procedures in order to avoid contaminating potential evidentiary material.

Affidavits and Search Warrants
1. Many investigations begin with an allegation or an indication of an incident.  The organization’s forensics team must then request permission to examine digital media for potential EM.
2. An affidavit, which is sworn testimony that certain facts are true.
3. Search warrant, which is permission to search for EM at the specified location or to seize items to return to the investigator’s lab for examination.

Digital Forensics Methodology
1. A crucial aspect of any digital forensic investigation, the process of identifying the potential EM and its probable location, and documenting the information in the search warrant or authorization document.
2. The principal responsibility of the response team is to acquire the information without altering it.  The biggest challenge is to show that the person under investigation is the one who stored, used and maintained the EM or who conducted the unauthorized activity.
3. There are other sources of potential evidence such as removable drives, CDs, DVDs, flash drives, memory chips or on other computers located outside the organization.  Non-electronic media may be a source of EM also, such as note pads and planners.
4. Handling the EM is an important consideration to preserve its integrity and provide strong assurance that it has not been altered.
5. Chain of evidence or chain of custody procedures, which involve detailed documentation of the collection, storage, transfer and ownership of collected evidence from crime scene through its presentation in court.
6. Another required step, to authenticate the recovered evidence by establishing that an analyzed copy or image is a true and accurate replica of the source EM.
7. The most complex part of an investigation is the analysis of the copy or image for potential EM, beginning with indexing.  During indexing, many investigatory tools create an index of all text found on the drive, allowing the investigator to quickly and easily search for a specific type of file.
8. The final step, to report the findings of an investigation to the appropriate authority, which could be law enforcement or management.

Evidentiary Procedures
1. When investigating digital malfeasance or performing root cause analysis, keep in mind that the results and methods of the investigation may end up in criminal or civil court, and that the proper evidentiary procedures must be followed.
2. Strong procedures for handling evidentiary material can reduce the probability of an organization losing a legal challenge.