From the course: Learning Cyber Incident Response and Digital Forensics

Unlock this course with a free trial

Join today to access over 23,500 courses taught by industry experts.

Preserving evidence

Preserving evidence

From the course: Learning Cyber Incident Response and Digital Forensics

Start my 1-month free trial Buy for my team

Preserving evidence

“

- [Instructor] In this lesson, we're going to discuss how to determine what evidence must be collected and retained. So now that you've been called onto the scene to collect the evidence during your forensic investigation, you need to determine what evidence must be collected and retained based on the specifics of this case that we're investigating. Now, our goal is to collect any evidence that we can find that will show the suspect had illegal images in their possession, either currently on their computer or in their previously deleted items that we can find if we analyze the slack space of their disc image. When we first arrive on the scene, it's going to be important for us to document what we see, since this is also important evidence. For example, what was on the screen when you first walked into the room, and looked at the monitor connected to that workstation? Was it showing their windows desktop?…

Contents