STEPS DESCRIBING FORENSIC PROCESS
- Describe the business scenarios that require digital evidence
- look at the risk and potential impact on the business from the various types of crimes and disputes.
- The aim of understanding business scenarios benefits the organization in the following ways:
- They reduce the impact of computer-related crime
- Dealing with court orders to release data
- Identify different types of potential evidence
- The purpose of this step is to source what evidence may be available from across the range of systems and applications in use.
- Evidence sources include:
- Equipment such as routers, firewalls, servers, clients, portables.
- Application software, such as accounting packages for evidence of fraud and activities
- Determine the evidence collection requirement
The purpose of this step is to produce an evidence requirement statement so that those responsible for managing the business risk can communicate with those running and monitoring information systems through an agreed requirement for evidence.
- Establish a capability for securely gathering legally admissible evidence to meet the requirement.
The organization knows the totality of evidence available and has decided which can be collected to address the company risks within a planned budget. The next step is to ensure that it is collected from the relevant sources and preserved as an authentic record with the evidence.
- Establish a policy for secure storage and handling of potential evidence.
This step aims to secure the evidence for the longer term once collected and facilitate its retrieval if required. It concerns the long-term or off-line storage of information that might be required for evidence at a later date.
- Ensure monitoring and auditing are targeted to detect and deter major incidents.
Evidence sources can be monitored to detect threatened incidents on time. It is all very well collecting the evidence, but this step is about making sure it can be used in detection.
- Specify circumstances when escalation to a full formal investigation
The decision as to whether to escalate the situation to management will depend on any indications that a major business impact is likely or that a full investigation may be required where digital evidence may be needed.
- Train staff so that all those involved understand their role in the digital evidence process and evidence’s legal sensitivities.
This step aims to ensure that appropriate training is developed to prepare staff for various roles. It is also necessary to ensure that staff is competent to perform any roles related to the handling and preserving evidence.
- Present an evidence-based case describing the incident and its impact.
The aim of an investigation is not just to find a culprit. An investigation has to provide answers to questions and demonstrate why those answers are credible.