Digital Forensics Procedures: Ensure Accuracy of Evidence Analysis

Follow Forensics Procedures for Accurate Analysis

You should follow forensics procedures, such as taking a hash of the image before using  it and checking regularly to ensure you have not modified it. You can select and use any proprietary or open source tools that you have been introduced to or find yourselves to perform the analysis and extract any evidence present.

Your report should detail the investigation process and the findings (including copies of relevant evidence), including obstacles and problems that you encountered and how you overcame them. You can assume that the reader has a light understanding of digital forensics, so any complicated terms/techniques/etc should be explained.

You must include some screenshots in your reports with the output of the tools or the process as and when necessary to support/show how you reached your conclusions. Screenshots should not be used to excess – they merely serve to demonstrate your understanding of the tools/processes and should be used to support written explanations (not in place of).

You will be marked based on the evidence you extract, the use of appropriate tools, the detail of the process, the explanation on its relevance to the case and documentation.

Remember, your report should present the information in an unbiased way.

Improper handling/validation of evidence would result in loss of marks except where accurately identified and corrected