4.5 Key aspects of digital forensics

Question 1

Digital forensics: what is digital forensics?

Answer 1

The process of collecting and protecting information relating to an intrusion

Question 2

Digital forensics: is there a feamework for digital forensics?

Answer 2

Yes, RFC 3227 - Guidelines for Evidence Collection and Archiving

Question 3

Digital forensics: what are the 3 steps of digital forensics process?

Answer 3

Acquisition, analysis and reporting

Question 4

Digital forensics: why documentation is important in digital forensics?

Answer 4

For legal reason, the documentation also needs to be kept a certain amount of time

Question 5

Digital forensics: what is chain of custody ?

Answer 5

A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the documents.

Question 6

Managing evidence: how to ensure data integrity when collecting data ?

Answer 6

By hashing it

Question 7

Managing evidence: how to preserve data that has been collected ?

Answer 7

Create a copy and isolate it. Work from copies of the data

Question 8

Managing evidence: what is E-discovery?

Answer 8

Refers to gathering data without consideration of intent