The Objective-Based Framework divides an investigation into three stages: preparation, investigation and presentation. Consider the article United States v Gorshkov Detailed Forensics and Case Study; Expert Witness Perspective (Item 2 in Class Exercise Resources).

1. Describe three activities that needed to be completed in the preparation stage.
2. The investigation phase includes triage, first response, crime scene management, lab preparation, evidence handling and evidence examination. FBI investigators gained remote access to the suspect's servers in Russia. Examination of the two servers tech.net.ru and freebsd.tech.net.ru is summarized in sections 4.1 through 4.5. Review sections 4.1 through 4.5 and explain the following:
   1. Triage: Investigators did not have physical access to the servers. How might that affect triage considerations?
   2. First Response: Outline the activities that were needed during first reponse to ensure a successful investigation and prosecution.
   3. Evidence Handling: This was an unusual situation in that the evidence is entirely digital. Physical drives or devices were not seized. Explain how investigators needed to adapt to properly handle evidence.
3. The presentation stage is used to present the results to attorneys or courts. Two critical requirements during presentation are to demonstrate the evidence is what it is claimed to be and that the methods to obtain that evidence were valid procedures. The evidence described in section 4.5, Analysis of Perl Scripts was collected remotely. Anticipate what might be needed to demonstrate:
   1. The evidence is what it is claimed to be: 1) Perl scripts, 2) Evidnce of criminal activity
   2. Valid acquisition procedures: Describe what investigators need to demonstrate in this case to prove their acquisition procedures were valid.