Digital Forensics Process

Front 1

Step 1

Back 1

Collection - data must be collected before it can be analyzed. This includes identifying, labeling, recording, and acquiring data from sources while following procedures to preserve the integrity of the data. This includes making a copy of the data in question by creating a bit-stream image, or bit-level copy, of the data. This bit-stream image captures all created sections of a HD, whether used or not, and alk unallocated drive space that doesn't belong to any partition.

*Reminder*

Never power down a device if it is powered on without first making a copy

Front 2

Step 2

Back 2

Examination - includes forensically processung collected data and assessing and extracting data of interest, while preserving the integrity of the data by always working from a copy.

Front 3

Step 3

Back 3

Analysis - using legally approved methods and techniques, derive information that addresses the questions that inspired the collection and examination.

Front 4

Step 4

Back 4

Reporting - digital forensics investigators are required to formally report the results of the analysis, which may include describing the actions used, explaining how tools and procedures were selected, determining what other actions need to be performed, and recommended improvements to the forensic process.