FORENSICS PLAN GUIDE
Foreword
This document does not discuss First Response roles and
responsibilities. The document starts from the point where an incident
has been verified and the determination has been made that a forensic
investigation is needed.
A Forensic Plan is a combination of dynamic checklist and template for recording computer investigation processing steps and information. The dynamic checklist aspect of the Forensic Plan originates from the precept that each investigation is unique. As such, each investigation has numerous contributing factors that have not been discovered nor anticipated during the planning phase of the investigation. Every investigation has components that are always required and present. These components create the basic framework of the checklist. The common phases of a forensic investigation are the identification phase, preservation phase, data collection phase, examination phase and reporting phase. As the investigation proceeds and more information is uncovered pertaining to other possible crimes, the checklist can be expanded to insure that the new information is properly documented and handled.
Since investigations have dynamic qualities, it would be inefficient to restructure current documentation each time new information was discovered. The establishment of a standard or template for recording investigative information facilitates accurate and timely recording of events, actions and information.
Key fingerprint = AF19 FA27 2F94defines a single concept for illustrating the basic elements of a This document 998D FDB5 DE3D F8B5 06E4 A169 4E46 Forensic Plan from the first initial contact through submission of the final Forensic Report. As the investigation proceeds through the forensic processes, checklist items will be accomplished and the results of those actions will be recorded in the Forensic Plan.
Often critical decisions are made during the initial contact and Preliminary Investigation Discussion (PID). This is where the scope and type of investigation are often decided. If an investigator is unprepared to discuss the requirements for a particular type of investigation, an inaccurate resource estimate will result. This often will lead to an unsuccessful investigation. The investigator must be prepared to discuss with management and properly estimate the resources required to complete the forensic investigation. Decisions made during the Preliminary Investigation Discussion will provide the framework for the forensic investigation. A framework is needed to insure that the agreed upon goals are accomplished.
During the forensic investigation, other information may be discovered that highlights other activities that need to be reported and possibly researched. The investigator must decide what items are essential to this particular investigation and restrict efforts accordingly.
A Forensic Plan is a combination of dynamic checklist and template for recording computer investigation processing steps and information. The dynamic checklist aspect of the Forensic Plan originates from the precept that each investigation is unique. As such, each investigation has numerous contributing factors that have not been discovered nor anticipated during the planning phase of the investigation. Every investigation has components that are always required and present. These components create the basic framework of the checklist. The common phases of a forensic investigation are the identification phase, preservation phase, data collection phase, examination phase and reporting phase. As the investigation proceeds and more information is uncovered pertaining to other possible crimes, the checklist can be expanded to insure that the new information is properly documented and handled.
Since investigations have dynamic qualities, it would be inefficient to restructure current documentation each time new information was discovered. The establishment of a standard or template for recording investigative information facilitates accurate and timely recording of events, actions and information.
Key fingerprint = AF19 FA27 2F94defines a single concept for illustrating the basic elements of a This document 998D FDB5 DE3D F8B5 06E4 A169 4E46 Forensic Plan from the first initial contact through submission of the final Forensic Report. As the investigation proceeds through the forensic processes, checklist items will be accomplished and the results of those actions will be recorded in the Forensic Plan.
Often critical decisions are made during the initial contact and Preliminary Investigation Discussion (PID). This is where the scope and type of investigation are often decided. If an investigator is unprepared to discuss the requirements for a particular type of investigation, an inaccurate resource estimate will result. This often will lead to an unsuccessful investigation. The investigator must be prepared to discuss with management and properly estimate the resources required to complete the forensic investigation. Decisions made during the Preliminary Investigation Discussion will provide the framework for the forensic investigation. A framework is needed to insure that the agreed upon goals are accomplished.
During the forensic investigation, other information may be discovered that highlights other activities that need to be reported and possibly researched. The investigator must decide what items are essential to this particular investigation and restrict efforts accordingly.
By : Gerald L. King
Download Link :
Forensic Classification of Imaging Sensor Types
ABSTRACT
Digital images can be captured or generated by a variety of sources including digital cameras and scanners. In many cases it is important to be able to determine the source of a digital image. Methods exist to authenticate images generated by digital cameras or scanners, however they rely on prior knowledge of the image source (camera or scanner). This paper presents methods for determining the class of the image source (camera or scanner). The method is based on using the differences in pattern noise correlations that exist between digital cameras and scanners. To improve the classification accuracy a feature vector based approach using an SVM classifier is used to classify the pattern noise.
Keywords: digital forensic, imaging sensor classification, flatbed scanner, sensor noise
By :Nitin Khannaa and Aravind K. Mikkilinenib
Download Link :
