All right, importance of the process.
All right, to reiterate, as digital
evidence is fragile in nature, following strict guidelines and thorough process
ensures the integrity of evidence critical to proof, case in court of law.
All right, in a nutshell, I'm going to...
A little bit of a giveaway here.
You make a forensic copy of the original evidence.
Minimize your footprint interaction with the system.
You authenticate that evidence, which
means you run a hash calculation, the original and the copy.
If those line up, you've got an exact replica of your original media.
If that's the case, then you seal up the original, tag it, bag it, don't ever touch
it again, and you work off the library control copies.
You make a copy of the copy, you
authenticate the copy, and that ensures that you're always working on a copy, not
the original, and you're not going to screw it up.
So it boils down to.
So the forensic investigation process should comply with local laws established
precedence, any breach or deviation may jeopardize the complete investigation.
Always follow process.
Now, you will potentially get presented with legal
issues during the proceedings that you as the investigator couldn't anticipate.
That's generally up to the attorney.
You don't have to be Perry Mason along with the cyber crime guy.
You need to follow proper procedure to ensure you avoid the pitfalls and the data
collection motions to suppress things like that.
That's generally the job of the attorney.
The investigators again, must follow
repeatable and well documented set of steps.
It's about the fourth time we've mentioned that.
Every iteration of analysis provides the same finding.
You should get the same result every time.
We talked about that.
Cross examination, they're going to try to pick that apart.
If you've ever seen Law and Order or any
other crime drama, you know how cross examination goes.
You introduce the expert witness with high
regards, pump them up, make them look good.
Whoever introduced the expert witness, and
then opposing counsel's job is to try to discredit them, make them look like they
don't know what they're talking about, make them over extend opinions, turn their
questions around on them, or turn their statements around on them.
Nested questions, leading questions, things like that.
Hostile cross examination.
Are phases involved in the forensic investigation process?
The pre investigation phase is all the planning.
That is procedure, policy writing, equipment development, setting up a
forensics lab, toolkits, approval from the relevant authority, etc.
The investigation phase is the actual investigation.
Main phase involving acquisition,
preservation, and analysis of evidential data.
Identify the source of the crime and the culprit behind it.
Your post investigation phase is the documentation and the reporting.
The report is a documentation of everything you found.
It's ordered based on relevance.
The procedure is documented in a timeline
fashion, but you illustrate your findings that help prove or disprove
whatever the facts at hand are that you're trying to prove or disprove.
So whether or not to inculcate or exculcate the defendant.