Investigative Computer Forensics: The Practical Guide for Lawyers, Accountants, Investigators, and Business Executives

CHAPTER 5

The Underpinnings of Investigative Computer Forensics

There are so many areas of study, technology, and experience that go into the making of a strong computer forensic investigator that they are hard to list, and depending on the circumstances of the investigation itself and the needs of the client, one set of experiences and skills that are highly developed may not be appropriate, whereas another set may be. Among the various skills and areas of expertise that I have found to be important within the investigative computer forensic world are a strong understanding of the seizure and examination of digital evidence, which is covered ad nauseam in this volume and in others, and an understanding of data classification and records management and how those concepts may impact your ability to analyze the data you've collected or provide you with insight into the best use of your resources during the collection phase.

Other skill sets that are important include a complete comprehension of deleted data and what data can be recovered, an understanding of backups and systems preservation, a working knowledge of computer crime and its analysis and reconstruction, and an understanding of a wide variety of other technologies, including social engineering, encryption, cyberprofiling, and even a well-developed sense of how contracts, agreements, and third-party instruments are crafted and implemented. These are all important underpinnings of a successful computer forensic investigation. ...