DF GU

Digital Forensics Process?

Incident response, managing digital evidence, preparing forensic documentation

Why should a crime scene be secured?

So that only authorised personnel are allowed at the crime scene to have control over all possible evidence.

identification of digital evidence?

digital devices and physical items

Chain of Custody (Continuity of Evidence)?

Takes place during the gathering of evidence, it is about keeping a record of all actions taken for every piece of evidence that is collected.

What to have for an effective chain of custody?

Bagging and tagging, contemporaneous notes

What is Bagging and Tagging?

A common way to handle evidence is through bagging and tagging. The bag will contain the evidence and the label will have a date and time to the officer that seized that evidence.

What are Contemporaneous Notes?

They are taken at the time, when information is fresh, this allows justification on any decision made

What are 3 types of data we can acquire and what do they do?

Volatile, Non Volatile, Latent. Volatile is when data is lost when power to the system is shut off, non volatile is when data is kept when power to a system is shut off, latent data is data that cannot be initially seen, it requires special software to be viewable like deleted files.

Why is the digital forensics process considered scientific, and what does that require?

The digital forensics process is a scientific one.

This means that it should be a repeatable process that, if it was conducted again, and all the same actions carried out, that the same results would be obtained

How can findings of a Digital Forensics investigation be presented?

A report, presentation, witness statement

Data Protection Act 2018

How personal information about living individuals should be handled