Title: 4.Conducting an Investigation
Course: IN 2005 Digital Forensics > Section: Module 2: Chapter 2 - Understanding Computer Investigations

Conducting an Investigation

1. You should start by gathering the resources you identified in your investigation plan.
2. Items needed for this phase, including:
  - Original storage media
  - Evidence custody form
  - Evidence container for the storage media
  - Bit-stream imaging tool
  - Forensic workstation to copy and examine your evidence
  - Securable evidence locker, cabinet, or safe

Gathering the Evidence

1. When you gather the evidence, you should avoid damaging the evidence.
2. The steps involved in gathering the evidence, including:
  - Meet the IT manager to interview him
  - Fill out the evidence form, have the IT manager sign it
  - Place the evidence in a secure container
  - Complete the evidence custody form
  - Carry the evidence to the computer forensics lab
  - Create forensics copies (if possible)
  - Secure evidence by locking the container

Understanding Bit-stream Copies

1. A bit-stream copy is a bit-by-bit copy of any storage medium.
2. A bit-stream image file is the container of a bit-stream copy. A bit-stream image is also known as forensic copy.
3. The target disk must match the original disk. See Figure 2-4 to illustrate your explanation.

Acquiring an Image of Evidence Media

1. The first rule of computer forensics is to preserve the original evidence. Conduct your analysis only on a copy of the data.
2. SeeFigures 2-5 through 2-7 that describe the steps to acquire a thumb drive image using ProDiscover Basic.

Analyzing Your Digital Evidence

1. Remember the job of a computer forensics investigator is to recover data from deleted files, files fragments, and complete files.
2. Deleted files linger on the disk until new data is saved at the same physical location.
3. See Figures 2-8 and 2-9 that show the steps to load and acquire an image into ProDiscover Basic.
4. Refer to Figures 2-10 and 2-11 to show you how to display the contents of the acquired data.
5. Data analysis can be the most time-consuming task.
6. Use Figures 2-12 through 2-15 that explain how to perform the following tasks with ProDiscover Basic:
  - Search for keywords of interest in the case
  - Display the results in a search results window in the work area
  - Click each file in the search results window and examine its content in the data area
  - Export the data to a folder of your choice
  - Search for specific filenames
  - Generate a report of your activities

This work is licensed under a “Creative Commons Attribution 4.0 International License”.

Butler is an “Equal Opportunity Employer/Program” and “Auxiliary Aids and Services are available upon request.