Forensics Process
Digital forensics is
The process of identifying, acquiring, processing, analysing, and reporting digital evidence. This is done in order to present in a court of law when required.
Possible sources of digital evidence
All digital devices and software’s which runs in these devices
Two of the most well-known standardization bodies are
ISO & NIST
Locard’s Exchange Principle is
“when a person or object comes in contact with another person or object, a cross-transfer of materials occurs”.
The goal of digital investigation is
To reconstruct the incident and find supporting or refuting evidence.
Forensically ready means
To be prepared to efficiently execute digital investigations and then present evidence to the intended audience
How many Hypothesis are possible in digital forensics investigation
As many as possible
The European Network of Forensic Science Institutes (ENFSI) Guidelines are about
Best Practice Manual for the Forensic Examination of Digital Technology.
The manual provides guidance for forensic laboratories
Scientific Working Group on Digital Evidence (SWGDE) deals with
Types of errors found in the implementation of digital forensic tools
The focus of the guidelines is to understand the limitations of tools and techniques
What are the principles of a forensics process
Evidence integrity & Chain of custody
Digital evidence can be
Any sort of digital file from an electronic source. This includes email, text messages, instant messages, files and documents extracted from hard drives, electronic financial transactions, audio files, and video files.
What is “useful” digital evidence?
Evidentiary weight in a court of law,
Relevant and sufficient for determining root cause,
Linking the attacker to the incident
The examination phase is
defined as the preparation and extraction of potential digital evidence from collected data sources.
Volatile data resides in ?
A. registries
B. cache
C. RAM
All
Various aspects of enterprise digital forensics readiness is
People
Policy, Processes, and Procedures
Legal aspects
Technology ( Tools & Infra)