Wrapping Up the Case
In Chapter 1, we discussed the phases of an investigation, which ended with the case closure phase. In this phase, evidence is disposed of according to the lifecycle process identified by the organization for their evidence. Likewise, the original equipment is also disposed of according to established retention policy. In this chapter, we will discuss some of the considerations for how to manage the lifecycle of evidence and specifically, the types of things that should be done as part of case closure and final disposition.
If you haven’t already defined all processes around the evidence lifecycle—from collection ...