Understanding the Six Stages of a Computer Forensics Investigation

Computer forensics investigations take plenty of your time to conduct. this is often not stunning given the increasing size of storage media that’s being encountered. as an example, laborious drives of many hundred Gigabytes don’t seem to be uncommon. additionally, the quantity of devices and information storage that has to be searched and analysed is additionally increasing. This should be conducted in a very strong manner which will be incontestible in court or to management at a later date.
We’ve divided the pc rhetorical examination method into six stages, conferred in their usual written account order.

Readiness

Forensic readiness is a very important and infrequently unnoticed stage within the examination method. In business pc forensics it will embody educating shoppers concerning system preparedness; as an example, rhetorical examinations can give stronger proof if a device’s auditing options are activated before any incident occurring.
Evaluation

The analysis stage includes the receiving of directions, the clarification of these directions if unclear or ambiguous, risk analysis and therefore the allocation of roles and resources. Risk Associate in Nursingalysis for enforcement might embody an assessment on the chance of physical threat on coming into a suspect’s property and the way best to counter it.
Collection

The main a part of the gathering stage, acquisition, has been introduced higher than.
Analysis

Analysis depends on the specifics of every job. The examiner sometimes provides feedback to the shopper throughout analysis and from this dialogue the analysis might take a unique path or be narrowed to specific areas. Analysis should be correct, thorough, impartial, recorded, repeatable and completed among the time-scales obtainable and resources allotted.
Presentation

This stage sometimes involves the examiner manufacturing a structured report on their findings, addressing the points within the initial directions together with any later directions. it might additionally cowl the other info that the examiner deems relevant to the investigation.
Review

As with the readiness stage, the review stage is commonly unnoticed or forgotten. this could result to the perceived prices of doing work that’s not billable, or the requirement ‘to get on with following job’.

However, a review stage incorporated into every examination will facilitate economize and lift the extent of quality by creating future examinations additional economical and time effective.
Prior to Associate in Nursing investigation, the analyst should build some preparations. as an example, what’s the aim of the investigation? this can ultimately confirm the tools and techniques used throughout the ensuing investigation.

Next, proof should be collected. This should be conducted robustly and maintain the integrity of the proof. Once the proof is collected, a replica of the fabric is formed and every one analysis is performed on the copy. This ensures that the initial proof isn’t altered in any method.

The analysis of the proof is conducted with forensics tools. as an example, analysing the Winchester drive of a pc needs the recreation of the logical structure of underlying software system. Once this is often done, the analyst might got to sorting and examine each living and deleted files to create an image of the suspect’s activities.

The analyst can then report any suspicious or malicious files and provide supporting proof. as an example, the time and date the file was created, accessed or changed and that user was accountable.

Finally, the analyst should gift proof. In enforcement, this is often to a court of law. progressively, with the expansion of the sector in internal company investigations, this can be to management.

The post appeared first on Blue Systems International.