Broadcast that all investigations applying the use of digital forensics apply the same basic methodology below:
Identify relevant EM.
Acquire (seize) the evidence without alteration or damage.
Take steps to assure that the evidence at every step is verifiably authentic and is unchanged from the time it was seized.
Analyze the data without risking modification or unauthorized access.
Report the findings to the proper authority.
Recommend that to support the selection and implementation of a methodology, legal counsel with local or state law enforcement is a likely option an organization should use.
Recommend that students review the following resources provided in the text that should be part of an organization’s library:
Electronic Crime Scene Investigation: A Guide for First Responders, 2nd Edition, April 2008 (https://www.ncjrs.gov/pdffiles1/nij/219941.pdf)
Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (www.justice.gov/criminal/cybercrime/docs/ssmanual2009.pdf)
Scientific Working Group on Digital Evidence: Published Guidelines and Best Practices (https://www.swgde.org/documents/published)
First Responders Guide to Computer Forensics (https://resources.sei.cmu.edu/asset_files/Handbook/2005_002_001_14429.pdf)
First Responders Guide to Computer Forensics: Advanced Topics (http://resources.sei.cmu.edu/asset_files/handbook/2005_002_001_14432.pdf)