Digital Forensics Processing and Procedures

5.5.12 Records and Documentation

Documenting each step of the information risk management process and maintaining records (i.e., proof of having performed a task) is imperative for the following reasons:

• it demonstrates that the process has been carried out correctly;

• it facilitates continuing monitoring and review;

• it facilitates sharing information and communication;

• it provides an accountability mechanism;

• it provides an audit trail;

• it provides evidence of decisions and processes made.

The level of documentation required will depend on the Forensic Laboratory’s requirements. The Forensic Laboratory document and record control procedures are given in Chapter 4, Sections 4.6.3 and 4.6.4.

5.6 Framework Stage 4: Implementation ...