Digital Forensics and Incident Response

Preparing a stage drive

Beyond having the necessary hardware and software to perform the forensic imaging, it is critical to pre-stage a location to hold the image or evidence file. For incident response teams, the best option to utilize as an evidence repository is an external USB or FireWire disk drive. This allows for a degree of portability, as incident responders may have to investigate an incident offsite or at a variety of locations without the benefit of a forensics laboratory.

There are two tasks that need to be performed on evidence drives prior to their use. The first is to ensure that the repository is free of any data. Incident response teams should have a policy and procedure that dictates that an evidence drive be wiped prior ...