Using Pro Discover Basic At A Fire -proof Locker Essay

967 Words Aug 9th, 2015 4 Pages
Once the evidence has been collected such as the DBA and HR personnel hard drives they will be place in a fire –proof locker.

B. The team will process the Lead DBA Computer system following these steps ,
1) Preservation
2) Collection
3) Analysis
4) Report

Preservation- Includes identifying the machine and it’s contents. The DBA PC will be Photograph. The cable cords and the ports will be tag. Once the machine is open the devices will be label and tag. A diagram will be created showing where the devices and cables are connected inside the unit.

Collection- The steps in collecting digital evidence are to avoid contamination of evidence, provide detail documentation of the evidence and to follow a methodical approach. The data on the DBA computer system will have to go through a static computer forensic acquisition process for acquiring the data. Since the machine is off this will be the best approach. I will be using Pro Discover basic to perform a drive image copy of the DBA’s Hard drive that is running Microsoft XP
Connect the DBA hard drive to my Forensic Workstation. Second , I will document the chain of evidence sheet with the type, model, and serial number. Third, I will disconnect the hard drive from the DBA computer. Before connecting the hard drive to my forensic station I will need to configure the drive’s jumpers . Once this is done I will connect the hard drive to a write-block device. A hardware device units is more reliable. I…

Related Documents