Handbook of Digital Forensics and Investigation

Chapter 2. Forensic Analysis

Eoghan Casey and Curtis W. Rose

Contents

Introduction21

Applying the Scientific Method to Digital Forensics23

Uses of Digital Forensic Analysis26

Data Gathering and Observation32

Hypothesis Formation48

Evaluating Hypotheses48

Conclusions and Reporting56

Summary61

References62

Introduction

The information stored and created on computers is a double-edged sword from a forensic perspective, providing compelling evidence in a wide variety of investigations but also introducing complexity that can trip up even experienced practitioners. Digital evidence can be used to answer fundamental questions relating to a crime, including what happened when (sequencing), who interacted with whom (linkage), the origination of a particular ...