Digital Forensic Processes

Table of Contents

Abstract …………………………………………………………………....3

Introduction …………………………………………………………….….4

Data Analysis Techniques…...………………………………………….….5

Data Reporting Techniques………………………………………………...6

How Data Analysis and Reporting Support Prosecution…….…………….8

Examples of Data Analysis and Reporting Techniques.………….………..9

Conclusion………………………………………………………….……..13

References ………………………………………………………………..14

Abstract

A digital forensic investigation is a special case of a digital investigation where the procedures and techniques that are used will allow the results to be entered into a court of law. For example, an investigation may be started to answer a question about whether or not contraband digital images exist on a computer. An average Microsoft Windows user may be able to answer this question by booting the computer and using the Find Files function, but these results may not be court admissible because steps were not taken to preserve the state of the computer or use trusted tools (Carrier, 2006). There are many different process models used within the digital forensics arena. The National Institute of Standards and Technology (NIST) define the basic forensic process as follows: Collection, Examination, Analysis, and Reporting. This paper will focus on the last two phases, Analysis and Reporting.

Digital Forensics Processes:

Analysis and Reporting Techniques

The digital investigation process involves formulating and testing hypotheses about the state of a computer. We must formulate hypotheses because we cannot directly observe digital events and states and therefore we do not know facts. We must use tools to observe the state of digital data, which makes them indirect observations. This is similar to being told about something instead of seeing it for yourself. The amount that you believe what you are told is based on how much you trust the person. With digital investigations, the confidence is based on the trust of...