Guide to Computer Forensics

and Investigations
Fifth Edition

Chapter 4
Processing Crime and Incident
Scenes
 Objectives

• Explain the rules for controlling digital evidence

• Describe how to collect evidence at private-sector
incident scenes
• Explain guidelines for processing law enforcement
crime scenes
• List the steps in preparing for an evidence search
• Describe how to secure a computer incident or
crime scene

Guide to Computer Forensics and Investigations Fifth Edition 2

© Cengage Learning 2015
 Objectives

• Explain guidelines for seizing digital evidence at

the scene
• List procedures for storing digital evidence
• Explain how to obtain a digital hash
• Review a case to identify requirements and plan
your investigation

Guide to Computer Forensics and Investigations Fifth Edition 3

© Cengage Learning 2015
 Identifying Digital Evidence

• Digital evidence
– Can be any information stored or transmitted in
digital form
• U.S. courts accept digital evidence as physical
evidence
– Digital data is treated as a tangible object
• Groups such as the Scientific Working Group on
Digital Evidence (SWGDE) set standards for
recovering, preserving, and examining digital
evidence
Guide to Computer Forensics and Investigations Fifth Edition 4
© Cengage Learning 2015
 Identifying Digital Evidence

• General tasks investigators perform when working

with digital evidence:
– Identify digital information or artifacts that can be
used as evidence
– Collect, preserve, and document evidence
– Analyze, identify, and organize evidence
– Rebuild evidence or repeat a situation to verify that
the results can be reproduced reliably
• Collecting digital devices and processing a criminal
or incident scene must be done systematically
Guide to Computer Forensics and Investigations Fifth Edition 5
© Cengage Learning 2015
 Understanding Rules of Evidence

• Consistent practices help verify your work and

enhance your credibility
• Comply with your state’s rules of evidence or with
the Government Rules of Evidence
• Evidence admitted in a criminal case can be used
in a civil suit, and vice versa
• Keep current on the latest rulings and directives on
collecting, processing, storing, and admitting digital
evidence

Guide to Computer Forensics and Investigations Fifth Edition 6

© Cengage Learning 2015
 Understanding Rules of Evidence

• Data you discover from a forensic examination falls

under your state’s rules of evidence
– Or the Government Rules of Evidence
• Digital evidence is unlike other physical evidence
because it can be changed more easily
– The only way to detect these changes is to compare
the original data with a duplicate
• Most federal courts have interpreted computer
records as hearsay evidence
– Hearsay is secondhand or indirect evidence
Guide to Computer Forensics and Investigations Fifth Edition 7
© Cengage Learning 2015
 Understanding Rules of Evidence

• Business-record exception
– Allows “records of regularly conducted activity,” such
as business memos, reports, records, or data
compilations
• Generally, digital records are considered
admissible if they qualify as a business record
• Computer records are usually divided into:
– Computer-generated records
– Computer-stored records

Guide to Computer Forensics and Investigations Fifth Edition 8

© Cengage Learning 2015
 Understanding Rules of Evidence

• Computer and digitally stored records must be

shown to be authentic and trustworthy
– To be admitted into evidence
• Computer-generated records are considered
authentic if the program that created the output is
functioning correctly
– Usually considered an exception to hearsay rule
• Collecting evidence according to the proper steps
of evidence control helps ensure that the computer
evidence is authentic
Guide to Computer Forensics and Investigations Fifth Edition 9
© Cengage Learning 2015
 Understanding Rules of Evidence

• When attorneys challenge digital evidence

– Often they raise the issue of whether computer-
generated records were altered or damaged
• One test to prove that computer-stored records are
authentic is to demonstrate that a specific person
created the records
– The author of a Microsoft Word document can be
identified by using file metadata
• Follow the steps starting on page 141 of the text to
see how to identify file metadata
Guide to Computer Forensics and Investigations Fifth Edition 10
© Cengage Learning 2015
 Understanding Rules of Evidence

• The process of establishing digital evidence’s

trustworthiness originated with written documents
and the “best evidence rule”
• Best evidence rule states:
– To prove the content of a written document,
recording, or photograph, ordinarily the original
writing, recording, or photograph is required
• Government Rules of Evidence
– Allow a duplicate instead of originals when it is
produced by the same impression as the original
Guide to Computer Forensics and Investigations Fifth Edition 11
© Cengage Learning 2015
 Understanding Rules of Evidence

• As long as bit-stream copies of data are created

and maintained properly
– The copies can be admitted in court, although they
aren’t considered best evidence
• Example of not being able to use original evidence
– Investigations involving network servers
– Removing a server from the network to acquire
evidence data could cause harm to a business or its
owner, who might be an innocent bystander to a
crime or civil wrong
Guide to Computer Forensics and Investigations Fifth Edition 12
© Cengage Learning 2015
 Collecting Evidence in Private-Sector
Incident Scenes

• Private-sector organizations include:

– Businesses and government agencies that aren’t
involved in law enforcement
• Non-government organizations (NGO) must comply
with state public disclosure and federal Freedom of
Information Act (FOIA) laws
– And make certain documents available as public
records
• FOIA allows citizens to request copies of public
documents created by federal agencies
Guide to Computer Forensics and Investigations Fifth Edition 13
© Cengage Learning 2015
 Collecting Evidence in Private-Sector
Incident Scenes

• A special category of private-sector businesses

includes ISPs and other communication companies
• ISPs can investigate computer abuse committed by
their employees, but not by customers
– Except for activities that are deemed to create an
emergency situation
• Investigating and controlling computer incident
scenes in the corporate environment
– Much easier than in the criminal environment
– Incident scene is often a workplace
Guide to Computer Forensics and Investigations Fifth Edition 14
© Cengage Learning 2015
 Collecting Evidence in Private-Sector
Incident Scenes

• Typically, businesses have inventory databases of

computer hardware and software
– Help identify the computer forensics tools needed to
analyze a policy violation
• And the best way to conduct the analysis
• Corporate policy statement about misuse of digital
assets
– Allows corporate investigators to conduct covert
surveillance with little or no cause
– And access company systems without a warrant
Guide to Computer Forensics and Investigations Fifth Edition 15
© Cengage Learning 2015
 Collecting Evidence in Private-Sector
Incident Scenes

• Companies should display a warning banner and

publish a policy
– Stating that they reserve the right to inspect
computing assets at will
• Corporate investigators should know under what
circumstances they can examine an employee’s
computer
– Every organization must have a well-defined process
describing when an investigation can be initiated

Guide to Computer Forensics and Investigations Fifth Edition 16

© Cengage Learning 2015
 Collecting Evidence in Private-Sector
Incident Scenes

• If a corporate investigator finds that an employee is

committing or has committed a crime
– Employer can file a criminal complaint with the police
• Employers are usually interested in enforcing
company policy
– Not seeking out and prosecuting employees
• Corporate investigators are, therefore, primarily
concerned with protecting company assets

Guide to Computer Forensics and Investigations Fifth Edition 17

© Cengage Learning 2015
 Collecting Evidence in Private-Sector
Incident Scenes

• If you discover evidence of a crime during a

company policy investigation
– Determine whether the incident meets the elements
of criminal law
– Inform management of the incident
– Stop your investigation to make sure you don’t
violate Fourth Amendment restrictions on obtaining
evidence
– Work with the corporate attorney on how to respond
to a police request for more information
Guide to Computer Forensics and Investigations Fifth Edition 18
© Cengage Learning 2015
 Processing Law Enforcement Crime
Scenes

• You must be familiar with criminal rules of search

and seizure
• You should also understand how a search warrant
works and what to do when you process one
• Law enforcement officer may search for and seize
criminal evidence only with probable cause
– Refers to the standard specifying whether a police
officer has the right to make an arrest, conduct a
personal or property search, or obtain a warrant for
arrest
Guide to Computer Forensics and Investigations Fifth Edition 19
© Cengage Learning 2015
 Processing Law Enforcement Crime
Scenes

• With probable cause, a police officer can obtain a

search warrant from a judge
– That authorizes a search and seizure of specific
evidence related to the criminal complaint
• The Fourth Amendment states that only warrants
“particularly describing the place to be searched,
and the persons or things to be seized” can be
issued

Guide to Computer Forensics and Investigations Fifth Edition 20

© Cengage Learning 2015
 Understanding Concepts and Terms
Used in Warrants

• Innocent information
– Unrelated information
– Often included with the evidence you’re trying to
recover
• Judges often issue a limiting phrase to the
warrant
– Allows the police to separate innocent information
from evidence

Guide to Computer Forensics and Investigations Fifth Edition 21

© Cengage Learning 2015
 Understanding Concepts and Terms
Used in Warrants

• Plain view doctrine

– Objects falling in plain view of an officer who has the
right to be in position to have that view are subject to
seizure without a warrant and may be introduced in
evidence
– Three criteria must be met:
• Officer is where he or she has a legal right to be
• Ordinary senses must not be enhanced by advanced
technology in any way
• Any discovery must be by chance

Guide to Computer Forensics and Investigations Fifth Edition 22

© Cengage Learning 2015
 Understanding Concepts and Terms
Used in Warrants

• The plain view doctrine’s applicability in the digital

forensics world is being rejected
• Example - In a case where police were searching a
computer for evidence related to illegal drug
trafficking:
– If an examiner observes an .avi file and find child
pornography, he must get an additional warrant or an
expansion of the existing warrant to continue the
search for child pornography

Guide to Computer Forensics and Investigations Fifth Edition 23

© Cengage Learning 2015
 Preparing for a Search

• Preparing for a computer search and seizure

– Probably the most important step in computing
investigations
• To perform these tasks
– You might need to get answers from the victim and
an informant
• Who could be a police detective assigned to the case,
a law enforcement witness, or a manager or coworker
of the person of interest to the investigation

Guide to Computer Forensics and Investigations Fifth Edition 24

© Cengage Learning 2015
 Identifying the Nature of the Case

• When you’re assigned a digital investigation case

– Start by identifying the nature of the case
• Including whether it involves the private or public
sector
• The nature of the case dictates how you proceed
– And what types of assets or resources you need to
use in the investigation

Guide to Computer Forensics and Investigations Fifth Edition 25

© Cengage Learning 2015
 Identifying the Type of OS or Digital
Device

• For law enforcement

– This step might be difficult because the crime scene
isn’t controlled
• If you can identify the OS or device
– Estimate the size of the drive on the suspect’s
computer
• And how many devices to process at the scene
• Determine which OSs and hardware are involved

Guide to Computer Forensics and Investigations Fifth Edition 26

© Cengage Learning 2015
 Determining Whether You Can Seize
Computers and Digital Devices

• The type of case and location of the evidence

– Determine whether you can remove digital evidence
• Law enforcement investigators need a warrant to
remove computers from a crime scene
– And transport them to a lab
• If removing the computers will irreparably harm a
business
– The computers should not be taken offsite

Guide to Computer Forensics and Investigations Fifth Edition 27

© Cengage Learning 2015
 Determining Whether You Can Seize
Computers and Digital Devices

• Additional complications:
– Files stored offsite that are accessed remotely
– Availability of cloud storage, which can’t be located
physically
• Stored on drives where data from many other
subscribers might be stored
• If you aren’t allowed to take the computers to your
lab
– Determine the resources you need to acquire digital
evidence and which tools can speed data acquisition
Guide to Computer Forensics and Investigations Fifth Edition 28
© Cengage Learning 2015
 Getting a Detailed Description of the
Location

• Get as much information as you can about the

location of a digital crime
• Identify potential hazards
– Interact with your HAZMAT (hazardous materials)
team
• HAZMAT guidelines
– Put the target drive in a special HAZMAT bag
– HAZMAT technician can decontaminate the bag
– Check for high temperatures

Guide to Computer Forensics and Investigations Fifth Edition 29

© Cengage Learning 2015
 Determining Who Is in Charge

• Corporate computing investigations

– Usually require only one person to respond to an
incident
• Law enforcement agencies
– Typically handle large-scale investigations
• Designate lead investigators in large-scale
investigations
– Anyone assigned to the scene should cooperate with
the designated leader to ensure the team addresses
all details when collecting evidence
Guide to Computer Forensics and Investigations Fifth Edition 30
© Cengage Learning 2015
 Using Additional Technical Expertise

• Determine whether you need specialized help to

process the incident or crime scene
• You may need to look for specialists in:
– OSs
– RAID servers
– Databases
• Finding the right person can be a challenge
• Educate specialists in investigative techniques
– Prevent evidence damage
Guide to Computer Forensics and Investigations Fifth Edition 31
© Cengage Learning 2015
 Determining the Tools You Need

• Prepare tools using incident and crime scene

information
• Create an initial-response field kit
– Should be lightweight and easy to transport
• Create an extensive-response field kit
– Includes all tools you can afford to take to the field
– When at the scene, extract only those items you
need to acquire evidence

Guide to Computer Forensics and Investigations Fifth Edition 32

© Cengage Learning 2015
 Determining the Tools You Need

Guide to Computer Forensics and Investigations Fifth Edition 33

© Cengage Learning 2015
 Determining the Tools You Need

Guide to Computer Forensics and Investigations Fifth Edition 34

© Cengage Learning 2015
 Determining the Tools You Need

Guide to Computer Forensics and Investigations Fifth Edition 35

© Cengage Learning 2015
 Preparing the Investigation Team

• Before initiating the search:

– Review facts, plans, and objectives with the
investigation team you have assembled
• Goal of scene processing
– To collect and secure digital evidence
• Digital evidence is volatile
– Develop skills to assess facts quickly
• Slow response can cause digital evidence to be
lost
Guide to Computer Forensics and Investigations Fifth Edition 36
© Cengage Learning 2015
 Securing a Computer Incident or
Crime Scene

• Goals
– Preserve the evidence
– Keep information confidential
• Define a secure perimeter
– Use yellow barrier tape
– Legal authority for a corporate incident includes
trespassing violations
– For a crime scene, it includes obstructing justice or
failing to comply with a police officer

Guide to Computer Forensics and Investigations Fifth Edition 37

© Cengage Learning 2015
 Securing a Computer Incident or
Crime Scene

• Professional curiosity can destroy evidence

– Involves police officers and other professionals who
aren’t part of the crime scene processing team
• Automated Fingerprint Identification System (AFIS)
– A computerized system for identifying fingerprints
that’s connected to a central database
– Used to identify criminal suspects and review
thousands of fingerprint samples at high speed
• Police can take elimination prints of everyone who
had access to the crime scene
Guide to Computer Forensics and Investigations Fifth Edition 38
© Cengage Learning 2015
 Seizing Digital Evidence at the Scene

• Law enforcement can seize evidence

– With a proper warrant
• Corporate investigators might have the authority only
to make an image of the suspect’s drive
• When seizing digital evidence in criminal
investigations
– Follow U.S. DoJ standards for seizing digital data
• Civil investigations follow same rules
– Require less documentation though
• Consult with your attorney for extra guidelines
Guide to Computer Forensics and Investigations Fifth Edition 39
© Cengage Learning 2015
 Preparing to Acquire Digital Evidence

• The evidence you acquire at the scene depends on

the nature of the case
– And the alleged crime or violation
• Ask your supervisor or senior forensics examiner in
your organization the following questions:
– Do you need to take the entire computer and all
peripherals and media in the immediate area?
– How are you going to protect the computer and
media while transporting them to your lab?
– Is the computer powered on when you arrive?
Guide to Computer Forensics and Investigations Fifth Edition 40
© Cengage Learning 2015
 Preparing to Acquire Digital Evidence

• Ask your supervisor or senior forensics examiner in

your organization the following questions (cont’d):
– Is the suspect you’re investigating in the immediate
area of the computer?
– Is it possible the suspect damaged or destroyed the
computer, peripherals, or media?
– Will you have to separate the suspect from the
computer?

Guide to Computer Forensics and Investigations Fifth Edition 41

© Cengage Learning 2015
 Processing an Incident or Crime
Scene
• Guidelines
– Keep a journal to document your activities
– Secure the scene
• Be professional and courteous with onlookers
• Remove people who are not part of the investigation
– Take video and still recordings of the area around
the computer
• Pay attention to details
– Sketch the incident or crime scene
– Check state of computers as soon as possible
Guide to Computer Forensics and Investigations Fifth Edition 42
© Cengage Learning 2015
 Processing an Incident or Crime
Scene

• Guidelines (cont’d)
– Don’t cut electrical power to a running system unless
it’s an older Windows 9x or MS-DOS system
– Save data from current applications as safely as
possible
– Record all active windows or shell sessions
– Make notes of everything you do when copying data
from a live suspect computer
– Close applications and shut down the computer

Guide to Computer Forensics and Investigations Fifth Edition 43

© Cengage Learning 2015
 Processing an Incident or Crime
Scene

• Guidelines (cont’d)
– Bag and tag the evidence, following these steps:
• Assign one person to collect and log all evidence
• Tag all evidence you collect with the current date and
time, serial numbers or unique features, make and
model, and the name of the person who collected it
• Maintain two separate logs of collected evidence
• Maintain constant control of the collected evidence
and the crime or incident scene

Guide to Computer Forensics and Investigations Fifth Edition 44

© Cengage Learning 2015
 Processing an Incident or Crime
Scene

• Guidelines (cont’d)
– Look for information related to the investigation
• Passwords, passphrases, PINs, bank accounts
– Collect documentation and media related to the
investigation
• Hardware, software, backup media, documentation,
manuals

Guide to Computer Forensics and Investigations Fifth Edition 45

© Cengage Learning 2015
 Processing Data Centers with RAID
Systems

• Sparse acquisition
– Technique for extracting evidence from large
systems
– Extracts only data related to evidence for your case
from allocated files
• And minimizes how much data you need to analyze
• Drawback of this technique
– It doesn’t recover data in free or slack space

Guide to Computer Forensics and Investigations Fifth Edition 46

© Cengage Learning 2015
 Using a Technical Advisor

• A technical advisor can help:

– List the tools you need to process the incident or
crime scene
– Guide you about where to locate data and helping
you extract log records
• Or other evidence from large RAID servers
– Create the search warrant by itemizing what you
need for the warrant

Guide to Computer Forensics and Investigations Fifth Edition 47

© Cengage Learning 2015
 Using a Technical Advisor

• Responsibilities
– Know all aspects of the seized system
– Direct investigator handling sensitive material
– Help secure the scene
– Help document the planning strategy
– Conduct ad hoc trainings
– Document activities
– Help conduct the search and seizure

Guide to Computer Forensics and Investigations Fifth Edition 48

© Cengage Learning 2015
 Documenting Evidence in the Lab

• Record your activities and findings as you work

– Maintain a journal to record the steps you take as
you process evidence
• Your goal is to be able to reproduce the same
results
– When you or another investigator repeat the steps
you took to collect evidence
• A journal serves as a reference that documents the
methods you used to process digital evidence

Guide to Computer Forensics and Investigations Fifth Edition 49

© Cengage Learning 2015
 Processing and Handling Digital
Evidence

• Maintain the integrity of digital evidence in the lab

– As you do when collecting it in the field
• Steps to create image files:
– Copy all image files to a large drive
– Start your forensics tool to analyze the evidence
– Run an MD5 or SHA-1 hashing algorithm on the
image files to get a digital hash
– Secure the original media in an evidence locker

Guide to Computer Forensics and Investigations Fifth Edition 50

© Cengage Learning 2015
 Storing Digital Evidence
• The media you use to store digital evidence usually
depends on how long you need to keep it
• CDs, DVDs, DVD-Rs, DVD+Rs, or DVD-RWs
– The ideal media
– Capacity: up to 17 GB
– Lifespan: 2 to 5 years
• Magnetic tapes - 4-mm DAT
– Capacity: 40 to 72 GB
– Lifespan: 30 years
– Costs: drive: $400 to $800; tape: $40

Guide to Computer Forensics and Investigations Fifth Edition 51

© Cengage Learning 2015
 Storing Digital Evidence
• Super Digital Linear Tape (Super-DLT or SDLT)
– Specifically designed for large RAID data backups
– Can store more than 1 TB of data
• Smaller external SDLT drives can connect to a
workstation through a SCSI card
• Don’t rely on one media storage method to
preserve your evidence
– Make two copies of every image to prevent data loss
– Use different tools to create the two images

Guide to Computer Forensics and Investigations Fifth Edition 52

© Cengage Learning 2015
 Evidence Retention and Media
Storage Needs

• To help maintain the chain of custody for digital

evidence
– Restrict access to lab and evidence storage area
• Lab should have a sign-in roster for all visitors
– Maintain logs for a period based on legal
requirements
• You might need to retain evidence indefinitely
– Check with your local prosecuting attorney’s office or
state laws to make sure you’re in compliance

Guide to Computer Forensics and Investigations Fifth Edition 53

© Cengage Learning 2015
 Evidence Retention and Media
Storage Needs

Guide to Computer Forensics and Investigations Fifth Edition 54

© Cengage Learning 2015
 Documenting Evidence

• Create or use an evidence custody form

• An evidence custody form serves the following
functions:
– Identifies the evidence
– Identifies who has handled the evidence
– Lists dates and times the evidence was handled
• You can add more information to your form
– Such as a section listing MD5 and SHA-1 hash
values

Guide to Computer Forensics and Investigations Fifth Edition 55

© Cengage Learning 2015
 Documenting Evidence

• Include any detailed information you might need to

reference
• Evidence bags also include labels or evidence
forms you can use to document your evidence
– Use antistatic bags for electronic components

Guide to Computer Forensics and Investigations Fifth Edition 56

© Cengage Learning 2015
 Obtaining a Digital Hash

• Cyclic Redundancy Check (CRC)

– Mathematical algorithm that determines whether a
file’s contents have changed
– Not considered a forensic hashing algorithm
• Message Digest 5 (MD5)
– Mathematical formula that translates a file into a
hexadecimal code value, or a hash value
– If a bit or byte in the file changes, it alters the hash
value, which can be used to verify a file or drive has
not been tampered with
Guide to Computer Forensics and Investigations Fifth Edition 57
© Cengage Learning 2015
 Obtaining a Digital Hash

• Three rules for forensic hashes:

– You can’t predict the hash value of a file or device
– No two hash values can be the same
– If anything changes in the file or device, the hash
value must change
• Secure Hash Algorithm version 1 (SHA-1)
– A newer hashing algorithm
– Developed by the National Institute of Standards
and Technology (NIST)

Guide to Computer Forensics and Investigations Fifth Edition 58

© Cengage Learning 2015
 Obtaining a Digital Hash

• In both MD5 and SHA-1, collisions have occurred

• Most digital forensics hashing needs can be
satisfied with a nonkeyed hash set
– A unique hash number generated by a software tool,
such as the Linux md5sum command
• Keyed hash set
– Created by an encryption utility’s secret key
• You can use the MD5 function in FTK Imager to
obtain the digital signature of a file
– Or an entire drive
Guide to Computer Forensics and Investigations Fifth Edition 59
© Cengage Learning 2015
 Obtaining a Digital Hash

Guide to Computer Forensics and Investigations Fifth Edition 60

© Cengage Learning 2015
 Reviewing a Case

• General tasks you perform in any computer

forensics case:
– Identify the case requirements
– Plan your investigation
– Conduct the investigation
– Complete the case report
– Critique the case

Guide to Computer Forensics and Investigations Fifth Edition 61

© Cengage Learning 2015
 Sample Civil Investigation

• Most cases in the corporate environment are

considered low-level investigations
– Or noncriminal cases
• Common activities and practices
– Recover specific evidence
• Suspect’s Outlook e-mail folder (PST file)
– Covert surveillance
• Its use must be well defined in the company policy
• Risk of civil or criminal liability
– Sniffing tools for data transmissions
Guide to Computer Forensics and Investigations Fifth Edition 62
© Cengage Learning 2015
 Sample Criminal Investigation

• Computer crimes examples

– Fraud
– Check fraud
– Homicides
• Need a warrant to start seizing evidence
– Limit searching area

Guide to Computer Forensics and Investigations Fifth Edition 63

© Cengage Learning 2015
 Sample Criminal Investigation

Guide to Computer Forensics and Investigations Fifth Edition 64

© Cengage Learning 2015
 Reviewing Background Information for
a Case

• Throughout the book, you use data files from the

hypothetical M57 Patents case
– A new startup company doing art patent searches
– A computer sold on Craigslist was discovered to
contain “kitty” porn
– It was traced back to M57 Patents
– An employee is suspected of downloading the porn

Guide to Computer Forensics and Investigations Fifth Edition 65

© Cengage Learning 2015
 Planning Your Investigation

• Background information on the case

– Main players:
• Pat McGoo, CEO
• Terry, the IT person
• Jo and Charlie, the patent researchers
• Police made forensic copies of:
– The image of the computer sold on Craigslist
– Images of five other machines found at M57
– Images of four USB drives found at M57

Guide to Computer Forensics and Investigations Fifth Edition 66

© Cengage Learning 2015
 Planning Your Investigation

• Police made forensic copies of (cont’d):

– RAM from the imaged machines
– Network data from the M57 Patents servers

Guide to Computer Forensics and Investigations Fifth Edition 67

© Cengage Learning 2015
 Conducting the Investigation:
Acquiring Evidence with OSForensics
• Follow the steps outlined on pages 168-172 of the
text
– To use OSForensics to analyze an image file

Guide to Computer Forensics and Investigations Fifth Edition 68

© Cengage Learning 2015
 Summary

• Digital evidence is anything stored or transmitted

on electronic or optical media
• In the private sector, incident scene is often in a
contained and controlled area
• Companies should publish the right to inspect
computer assets policy
• Private and public sectors follow same computing
investigation rules
• Criminal cases
– Require warrants
Guide to Computer Forensics and Investigations Fifth Edition 69
© Cengage Learning 2015
 Summary
• Protect your safety and health as well as the
integrity of the evidence
• Follow guidelines when processing an incident or
crime scene
– Security perimeter
– Video recording
• As you collect digital evidence, guard against
physically destroying or contaminating it
• Forensic hash values verify that data or storage
media have not been altered
Guide to Computer Forensics and Investigations Fifth Edition 70
© Cengage Learning 2015
 Summary

• To analyze computer forensics data, learn to use

more than one vendor tool
• You must handle all evidence the same way every
time you handle it
• After you determine that an incident scene has
digital evidence, identify the digital information or
artifacts that can be used as evidence

Guide to Computer Forensics and Investigations Fifth Edition 71

© Cengage Learning 2015