Investigating the Cyber Breach: The Digital Forensics Guide for the Network Engineer, First Edition

Chapter 5

Investigations

“After all, we are nothing more or less than what we choose to reveal.”{99}

—Francis Underwood, House of Cards

In the previous chapters, we covered some basic forensic concepts. Now it’s time to focus on the technical aspects and engineering tasks of a forensics investigation. At this point, you should have a general understanding of how to build a team, develop a forensic lab, and create a manager’s view of a forensic investigation. This chapter focuses on what is involved with a forensics investigation from the beginning to when you hand off your results in the form of a forensic report to the party requesting your services.

In this chapter, we first look at items that should be on your pre-investigation checklist. ...