Title: 1. Taking a Systematic Approach
Course: IN 2005 Digital Forensics > Section: Module 2: Chapter 2 - Understanding Computer Investigations

Taking a Systematic Approach

1. Step to problem solving, including:
  - Make an initial assessment about the type of case you are investigating
  - Determine a preliminary design or approach to the case
  - Create a detailed checklist
  - Determine the resources you need
  - Obtain and copy an evidence disk drive
  - Identify the risks
  - Mitigate or minimize the risks
  - Test the design
  - Analyze and recover the digital evidence
  - Investigate the data you recover
  - Complete the case report
  - Critique the case

1. The amount of time and effort for each step varies depending on the case you investigate.

1. Present a list of case details. The list should include:
  - Situation
  - Nature of the case
  - Specifics of the case
  - Type of evidence
  - Operating system
  - Known disk format
  - Location of evidence

Planning Your Investigation

1. Outline the basic steps when planning an investigation:
  - Acquire the evidence
  - Complete an evidence form and establish a chain of custody
  - Transport the evidence to a computer forensics lab
  - Secure evidence in an approved secure container
  - Prepare a forensics workstation
  - Obtain the evidence from the secure container
  - Make a forensic copy
  - Return the evidence to the container
  - Process the forensic copy with appropriate tools

1. A broken chain of custody can throw out your case. Therefore, documenting evidence is very important during a forensics analysis.

1. See Figures 2-2 and 2-3 to explain the use of evidence custody forms, either single-evidence or multi-evidence, and the fields typically included in these forms:
  - Case number
  - Investigating organization
  - Investigator
  - Nature of the case
  - Location evidence was obtained
  - Description of evidence
  - Vendor name
  - Model number or serial number
  - Evidence recovered by
  - Date and time
  - Evidence placed in locker
  - Item #/Evidence processed by/Disposition of evidence/Date/Time
  - Page

Securing Your Evidence

1. Some of the considerations to follow when handling computer evidence:
  - Static electricity
  - Padding to prevent damage during transportation
  - Sealing openings with evidence tape
  - Writing initials on tape to prevent evidence from being altered
  - Temperature and humidity ranges

This work is licensed under a “Creative Commons Attribution 4.0 International License”.

Butler is an “Equal Opportunity Employer/Program” and “Auxiliary Aids and Services are available upon request.