Digital Forensics
Preserve the sources. Protect the questions.
Plan a documented collection around the evidence you need, the systems involved and the authority for the work.
01
Start with scope, not a shopping list of devices.
Identify the issues in the matter, relevant people, dates and potential evidence sources. The collection plan should reflect both the questions and practical constraints, including access, business operations and the handling of unrelated information.
02
Choose an appropriate collection method.
Discuss on-site, remote or laboratory collection where suitable. A computer image, an account export and a targeted collection serve different purposes. The reason for the chosen method, and its limitations, should be clear.
03
Make the work traceable.
Document the sources, collection details, handling and relevant verification steps. Keep a record of decisions that affect the evidence so that later examination and reporting can explain what was collected and how.
RELEVANT SOURCES
Start with what is available.
Discuss the sources that can help answer the question, within an authorized scope.
Computers and storage mediaBEFORE WE BEGIN
A more useful first conversation.
- Identify the devices and account owners.
- Explain the relevant date ranges and questions.
- Arrange authorized access through an agreed secure channel.
RELATED ARTICLES
Useful before you need us.
Practical perspectives and clear next steps.
YOUR NEXT STEP
What do you need to understand?
Tell us what you need to understand.