System Forensics, Investigation, and Response, 3rd Edition

Documentation of Methodologies and Findings

Documentation of forensic processing methodologies and findings is critical. Without proper documentation, a forensic specialist has difficulty presenting findings. When security or audit findings become the object of a lawsuit or a criminal investigation, the legal system requires proper documentation. Without documentation, courts are unlikely to accept investigative results. Thus, a system forensics specialist must know the ins and outs of computer evidence processing methodology. This methodology includes strong evidence-processing documentation and good chain-of-custody procedures.

Disk Structure

A system forensics specialist should have a good understanding of how computer hard disks and ...