Digital Forensics, Investigation, and Response 5E, 5th Edition

Forensic Methodologies

You will learn specific techniques for computer forensics; however, it is important that you have a general framework for approaching forensics. This section examines general principles and specific methodologies you can apply to your own forensic investigations. First, here are some basic principles to consider.

Handle Original Data as Little as Possible

A forensics specialist should touch the original data as little as possible. Instead, information should be copied prior to examination. This means that the first step in any investigation is to make a copy of the suspected storage device. In the case of computer hard drives, you make a complete copy, known as a bit-level copy. You can do this using tools such as EnCase, ...