Digital Forensics and Incident Response - Second Edition

Digital forensics lab

Digital forensics is an exacting process that involves the use of proper tools, techniques, and knowledge in order to extract potential evidence from systems. It is imperative that forensic examiners have a location that is separate from normal business operations. The best approach to achieving this separation is to provide CSIRT members directly involved in the examination of digital evidence with a location that is completely separate from the rest of the organization. A digital forensics lab should have several key features, to ensure that examiners have the necessary privacy but also to ensure the integrity of the evidence while it is being examined.