How to look without destroying.
WHAT TO ESTABLISH BEFORE EXAMINING ANYTHING
That the original is preserved and you are working on a copy.
HOW COPIES ARE MADE
Using a method that reads without writing Verified against the original
WHY WITHOUT WRITING
Any write changes the evidence.
WHAT TO ESTABLISH
That the examination environment is isolated.
WHY
Material under examination may be malicious.
WHAT TO AVOID
Examining on a production system Connecting the copy to your network Running unknown software from the evidence
WHAT TO USE
An isolated machine, or an environment that can be discarded.
WHAT TO RECORD DURING EXAMINATION
What was examined What tools were used, and their versions What was found, with where it was found What conclusions were drawn
WHY TOOLS AND VERSIONS
Findings must be reproducible.
WHAT TO ESTABLISH
That another competent person could repeat the work and reach the same result.
WHY
It is the test of whether the finding can be relied upon.
WHAT TO BE CAREFUL WITH
Interpreting findings beyond what they show Assuming a file's presence proves who put it there Assuming activity under an account proves who performed it
WHY THAT LAST POINT
Accounts are shared, compromised and used by others.
WHAT TO ESTABLISH
What the evidence actually demonstrates, and what it does not.
WHAT TO SEPARATE
Fact from inference.
WHY
Conclusions presented as facts are challenged and they undermine everything else.
WHAT TO RECORD
Both, clearly distinguished.
