Forensic Procedures

Question 1

What ensures that personnel handle forensics properly, effectively, and in compliance with required regulations?

Answer 1

Forensic Procedures

Question 2

What are the four main area’s of forensic procedures?

Answer 2

Identification
Collection
Analysis
Reporting

Question 3

What phase of forensic procedures ensures the scene is safe and secure to prevent evidence contamination, and identifies the scope of evidence to be collected?

Answer 3

Identification

Note: Imagine that you are the police arriving on scene, you have to make sure its safe before you can start investigating.

Question 4

In what phase must you obtain authorization to collect evidence, and then document and prove the integrity of the evidence as its collected?

Answer 4

COLLECTION

Question 5

In what phase must you create copies of evidence and use repeatable methods and tools?

Answer 5

ANALYSIS

Question 6

In what phase do you create a report of the methods and tools used in the investigation, and present the detailed findings?

Answer 6

REPORTING

Question 7

What is the first ethical principal of collecting forensic data?

Answer 7

The analysis must be performed without bias

Question 8

What is the second ethical principal of collecting forensic data?

Answer 8

Analysis methods must be repeatable by third parties

Question 9

What is the third ethical principal of collecting forensic data?

Answer 9

Evidence must not be changed or manipulated

Question 10

When building a forensic timeline, what are 5 questions you need to answer?

Answer 10

How was access to the system obtained?
What tools have been installed?
What changes to files were made?
What data has been retrieved?
Was data exfiltrated?