COUPON: Rent Computer Forensics Investigation Procedures and Response (CHFI) 2nd edition (475) and save up to 80% on textbook rentals and 90% on used textbooks. Get FREE 7-day instant eTextbook access!
Forensics Team Oversight
Leighton R. JohnsonIII, in Computer Incident Response and Forensics Team Management, 2014
The Forensics Team should always follow a structured documented process, wherein the content of the items to be investigated need to be preserved, validated, and documented. Any investigation must be understood at the onset as to its dimensions, scope, and investigative methods which are best based upon proven techniques, such as proper and legal collection of evidence and obtaining proper bit-stream “hash encrypted” copies of evidence. The linear nature of investigation always needs documentation and supporting evidence, for technology can give unexpected results. So, always document everything and report everything.