Lab 16: Introduction to Digital Forensics

• Identification

The first step is to identify the potential resources /devices as well as identify the owners of said devices. It is important to get the correct permission in order to obtain the information needed for the investigation. If this step is not done correctly the data collect can be void as it was obtained unlawfully.

• Preservation

In order to maintain the integrity of the data collected it is important to document all the evidence found as well as how it was collected. Pictures of the crime scene need to be correctly labeled and stored to maintain integrity of the data.

• Collection

When it comes to collecting data from devices the data being collected needs to be specific to the crime involved and cannot be unrelated. The manner of data collection from digital devices can either be copying the device’s content, creating images of the device so that the information can be reviewed at a latter date and finally printing out data into hard copies. In order to maintain a proper book keeping system recording time stamps along with before and after pictures of the collection process will help safe guard the officer in charge from any potential unlawful data collection breaches.

• Analysis

In this step the data collected is reviewed and educated assumptions are made based on the data found. If the data has been corrupted a team of forensic officers will try reclaim as much of corrupted data as they can in order to use the data to build a case.

an example of this would be officers reviewing footage of a bank robbery where the build evidence from the data provided from the bank’s camera footage.

• Presentation

For this step the finds of their investigation are presented to the courts. It is important to note that in order to make sure the findings are understood correctly the presentation language should be in layperson’s terms.