Chapter 6. Controlling a Forensic Investigation

A COMPUTER FORENSICS CRIME SCENE INVESTIGATION should begin with a plan to approach and secure the crime scene. As a forensic specialist, you must identify and collect evidence or potential evidence, and you must process and analyze the evidence so that it has value in court. Forensic specialists must carefully document crime scene activity and all activity related to evidence.

Computer evidence frequently faces challenges in court. Most challenges are related to the evidence's authenticity. The courts want to know whether the data was altered. They also question whether the program that generated the output was reliable. Other challenges in court can involve the forensic analyst. Attorneys sometimes ...

Get System Forensics, Investigation, and Response now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.