Appendix A: Investigative Process Models


Ever since forensic science became an established component of digital forensics, there have been a number of suggested and proposed process models. As early as 1984, law enforcement agencies began developing processes and procedures around computer forensic investigations. This led to the determination that as a result of bypassing, switching, or not following correct processes, the investigation could result in incomplete or missed evidence.
To examine the specified process models, the components of each model have been standardized to describe the activities performed as part of the investigative workflow. The term “process model” is used to represent all activities included in the proposed ...

Get Implementing Digital Forensic Readiness now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.