Digital Forensic Investigation Process

Flashcards to review key vocabulary and concepts from the Digital Forensic Investigation Process lecture.

Digital Forensic Investigation Process

A methodological approach to managing a case from initial search and seizure to final reporting.

Pre-Investigation Phase

The phase involving setting up the lab, building the team, and obtaining management approval.

Investigation Phase

The active stage of the forensic process where evidence is acquired, preserved, and analyzed.

Post-Investigation Phase

The phase of reporting findings and providing expert testimony in court.

Chain of Custody

A document that records the sequence of custody and possession of evidence.

Write Blockers

Hardware tools used to prevent accidental modification of data during forensic investigation.

FRED (Forensic Recovery of Evidence Device)

A high-performance machine used in forensic investigations.

Incident Responder

The team member responsible for taking immediate action when a breach occurs.

Expert Witness

A professional who provides formal testimony based on their specialized knowledge and expertise.

Documentation

The meticulous record-keeping of the crime scene and related evidence.

Search and Seizure

The legally and physically securing of evidence during an investigation.

Data Acquisition Tools

Software tools used to create forensic copies of data such as FTK.

Analysis

The examination of collected data to find proof of the crime.

Established Precedents

Case law knowledge that helps investigators protect organizations and prepare admissible evidence.

Physical Security Requirements

Measures to protect sensitive evidence and hardware from unauthorized access.

Forensic Lab

A dedicated space equipped with specialized hardware and software for forensic investigations.

Evidence Examiner

A team member who sorts through and analyzes data for usefulness.

Legal Counsel

An attorney who provides legal advice throughout the investigation process.

Acquisition

The process of making forensic copies of data for analysis.

Testifying

The expert's responsibility to explain findings as an expert in a court of law.

Security Measures

Protocol such as electronic sign-ins and alarms to protect the forensic lab.