Forensic Process Phases

Question 1

Identification

Answer 1

Identification / Seizure phase; primary stage in arrival, identification and evidence collection

Question 2

Acquisition and Imaging

Answer 2

Dig. evidence is acquired, through obtaining a forensic copy or a logocal extraction of data stored on a device

Question 3

Analysis

Answer 3

Includes the processes and procedures performed on evidence

Question 4

Reporting

Answer 4

Includes the documentation and presentation of the analysis findings

Question 5

Analysis Breakdown

Answer 5

Performing link / timeline / file signature analysis

Data carving - reassemble fragmented files in unallocated / free space

Advanced Searches - keywords/watchlists, regular expressions/pattern
analysis, and dates

Background info - first responders / detectives or complainant

Location based data from commercially available tools

Question 6

Reporting Findings

Answer 6

Report breakdown;
Establishes background,

Documents the evidentiary chain of custody,

Identifies in detail the seized media,

Documents the steps taken to preserve evidence,

Describes processes used to acquire and analyse,

Details findings