Cyber Forensics: From Data to Digital Evidence

CHAPTER TEN

Cyber Forensics

Investigative Smart Practices

IT IS IMPORTANT TO SPEND just a moment before proceeding, to discuss the difference, albeit potentially subtle, between “smart” and “best” or even “good” practices.

“Best” or even “good” practices are typically grounded in data, analytical analysis, baselines, perceptions, and practices supported by the actions or results of primarily a single company that catches the eye of an industry, which in turn is then joined by other organizations mimicking or adopting these practices over time, inevitably resulting in the establishment of a “best practice.” There seems to be something circular or maybe even incestuous about best practices.

In Chapter 10, the concept of Investigative Smart Practices is introduced. These Investigative Smart Practices are embedded within the sequential “steps” taken during a cyber forensic investigative process.

Smart practices underline the fact that any practice worth such special attention, while also utilizing data and analytical analysis, ought usually to capture the inventiveness required to go beyond “following the pack” to applying independent, logical thought to approaching and solving problems. This means that actions are taken because they are the smartest decisions to make, and steps to take, not simply because others have done so. Smart practices are also defensible on their own and do not rely on “group” approval or acceptance.

Smart practices are employed to help overcome obstacles ...