Investigative Computer Forensics: The Practical Guide for Lawyers, Accountants, Investigators, and Business Executives

CHAPTER 6

Tactical Objectives and Challenges in Investigative Computer Forensics

The technical challenges the computer forensic examiner faces are broad and varied and with each case they differ. Therefore, it is important as an investigator not only to have a solid grounding in the fundamental mechanics of computer forensics, but also to understand the interplay and relationships between various potential interested parties. The consumer of computer forensic investigations, such as an attorney, or business executive, or others who order investigations to take place, are often well served to ensure that the computer forensic examiners who are collecting and analyzing the data are in fact aware of the broader mandate and circumstances that brought them to this place. Not seeing the forest for the trees, whether intentional or not, can lead to missed opportunities and clues being overlooked or overstated. See Exhibit 6.1.

EXHIBIT 6.1 The Ubiquitous Computer

Computers come in a variety of forms, from desktop to tablet, handheld to embedded within other components such as an automobile. Regardless of the shape, size, speed, and capacity of the computers they work on, computer forensic investigators' process and procedures are uniformly applied to the identification, preservation, collection, processing, analysis, and presentation of the data that they contain, thereby assuring predictable reliance on the findings and conclusions drawn from the investigation.

Among the objectives ...