Investigating Windows Systems

Chapter 1

The Analysis Process

Abstract

Forensic analysis is an iterative process; analysts do not take one walk through the data and are then done. Rather, an analyst will start by looking for something, and may find additional items or “pivot points” that take their analysis in a new direction. At the same time, analysts need to be careful to avoid “rabbit holes,” points of interest during analysis that take them off track. Finally, significant value has been demonstrated in developing intelligence from an investigation and “baking it back into” both tools and processes.

Keywords

Analysis; process; documentation; sharing

Chapter Outline

• Introduction 1
• The Analysis Process 2
  • Goals 5
  • Analysis Plan 6
  • Reporting 10
  • Lessons Learned 11
• The Rest of This ...