Chapter 4: CommonTasks


In This Chapter

  • Identifying evidence

  • Preserving evidence

  • Analyzing evidence

  • Presenting evidence

The goal of computer forensics is to get to the truth. You get to the truth by identifying and acquiring sufficient evidence to prove the identity or the activities of a computer user . Items of interest to investigators and examiners are either the result of prohibited activity or those that support other prohibited activity. The previous chapter discussed computer evidence and the process of collecting and handling it. This chapter looks at the entire forensic process from a common flow approach.

You will learn the basic tasks present in nearly all forensic investigations. When you first approach a crime scene, you must identify any and all pertinent evidence. After you have identified the evidence, you will collect it and handle it in a manner that preserves its state. Remember from the previous chapter that you always want to treat evidence, at least initially, as though it will be admitted into a court of law. After you have custody of the evidence, you can analyze it and present your findings.

This chapter addresses common tasks that are common to computer investigations.




Computer Forensics JumpStart
Computer Forensics JumpStart
ISBN: 0470931663
EAN: 2147483647
Year: 2004
Pages: 153

Similar book on Amazon

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net