Digital Forensics, Investigation, and Response 5E, 5th Edition

Documentation of Methodologies and Findings

Documentation of forensic processing methodologies and findings is critical. Without proper documentation, a forensics specialist has difficulty presenting findings. When security or audit findings become the object of a lawsuit or a criminal investigation, the legal system requires proper documentation. Without documentation, courts are unlikely to accept investigative results. Thus, a system forensics specialist must know the ins and outs of computer evidence processing methodology, which includes strong evidence-processing documentation and good chain-of-custody procedures.

Disk Structure

A system forensics specialist should have a good understanding of how computer hard disks, flash drives, and ...