Structure and Approach

azrael · 2007-07-17T14:32:49Z

I think that if you create a forum, the question of should it be a single specific methodology or a general methodology would be one if the first issues addressed by the forum.I would think it will be impossible to create a general methodology that would cover most scenarios so maybe a single document that had different sections for each major part of the forensic investigation?It seems to me that there are two basic structures that we can takea) One single, comprehensive document.b) Multiple documents, each covering a specific area, with an overseeing guide to their combination and usage.I must admit that I started off thinking about doing (a) but as time goes on I am really heading down the route of (b). I think that this will allow the workload to be better distributed amongst willing participants, will allow individual sections to be kept up-to-date rather than having to review a full document, and will make for easier referencing and day-to-day use.I _do_ think though that an overseeing document is vital, something that says"You are doing a fraud investigation, you should look at sections (3) E-mail, (4) Documents, (6) Accounts Programs and (9) Databases"and"You are doing a stalking case investigation, you should look at sections (2) Images, (3) E-mail, (4) Documents and (5) Chat Logs"This structure relates quite well to the U.S. DoJ "Electronic Crime Scene Investigation" Chapter 7 - http//www.forensicfocus.com/index.php?name=Downloads&d_op=viewdownloaddetails&lid=4&title=ElectronicCrimeSceneInvestigationAGuideforFirstResponders(pdf)If you look at other methodologies, there is also often included a "Code of Ethics" relating to that profession … This is obviously something that everybody here adheres to is a massive way - has one been defined at all ? Is this something that we should consider doing ? If so, the place for this would be in this overseeing document.With regard to approach …An idea, due to the huge number of topics involved in CF, what about using the "programming by interfaces" paradigm and trying first to describe the generic approach to an artifact (i.e. a rdbms, a vm, etc.) then "implement" the concept on the specific (i.e. mysql, vmvare, etc.).How does it sound to you ?We were never actually taught one but were required to develop 3 draft methodologies.Do you still have them available ? How did you approach it ?See the new ACPO guidelines are out …Reading it seems pretty good … updated for wireless/networks/live analysis.Not a bad read at all, and has lots of useful information thou does lack some technical details (then again its not meant to be too technical).Might be a good base to start from?Comments please ? Suggestions ?

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Anonymous 18 years ago

11 Posts

5 Users

0 Reactions

616 Views

RSS

Anonymous

(@Anonymous)

Guest

Joined: 1 second ago

Posts: 0

20/07/2007 3:13 am

I think creating trees with one-to-many relationships is going to be cumbersome to navigate at the end.

I think specific procedures could be sequential and tree shaped as described above, but methodologies are much more cross pollinating for such restrictive layout.

ReplyQuote

Page 2 / 2 Prev

Podcast: Well-Being In Digital Forensics And Policing: Insights From Hannah Bailey

Hannah Bailey shares her journey from frontline policin...

By Zoe , 19 hours ago
RE: Android Forensics

Hi, Try decompressing the file using zlib in python. ...

By Dexter4n6 , 2 days ago
Interview: Neal Ysart, Co-Founder, The Coalition of Cyber Investigators

Neal Ysart shares how The Coalition of Cyber Investigat...

By Zoe , 2 days ago

8 Forums
15.7 K Topics
92.3 K Posts
266 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed