It is a process that focuses on recovery of evidence for the investigation. Data that found can be used as evidence in a court of law. The process consists of identification, preservation, collection, documentation and reporting. In these processes, forensic practitioner is required to follow the standard procedures.  It helps to identify the evidence and allow the examiner to postulate the motive of the suspect. Today, let EHDR, a Singapore data recovery centre will about the step of digital forensics.

Identification

This this first step, specialist needs to identify the potential devices that hold crucial information. The officer is required to record all necessary information and condition of the device. Details such as the device information, and location.

Preservation

After identifying the potential device, the specialist will preserve all relevant device. The device will be isolated, secure or capturing visual images to preserve the original incident scene.

Collection

Next, specialist is required to remove the device from the scene and data acquisition will be done in this step. Forensic methodology is needed in this process. Imaging, copying, or printing of the content so that the original copy of data accumulated will be preserved.

Analysis

As the data and information from the device is collected and saved in unstructured form, the data analysis process is very important because this process aims to discover the patterns and fraudulent activities by converting all collected informing into structured data. Keywords will be applied in this process.

Documentation and Reporting

All extracted and visible data will be documented. The goal of the documentation process is to record all related information to support the legal and decision maker. A good documentation and reporting will help to express, verify the finding, and communicate what is done in the investigation and can be justified in court.

Conclusion

The process that stated above is crucial because all the extracted information must be valid and need to be justified in court. If you encountered any civil or criminal related issue, it is important to maintain it at original condition. Preserve the suspect device and reach out professional service provider for advice.

EHDR, We Leave No Data Behind!