The Digital Forensic and Documentation

Hi Everyone,

I don't have a lot of working knowledge of Digital Forensic but I have accumulated the following a good investigator or a newbie (like me) should keep in mind during the investigation.

As I studied, forensic investigation is a 5 phase process

1. Identification
2. Preservation
3. Acquisition
4. Analysis
5. Presentation (Reporting)

A little mistake can spoil the cake.

The more you guzzle the more you can take out from the puzzle.

Every case has a new face.

The more you have in hand, The more you can expand.

Always follow the procedure, before or after the seizure.

Felon will try to conceal, Investigator will try to reveal, the truth.

Some of the tips to keep the documentation nice and aid for investigation as I could find.

Either a corporate investigation or a criminal one the result depends how & what you have done. I have developed my own checklist that every a good forensic investigator should have at one little corner of their brain before they carry out any fresh case

1. As you step in to the crime scene, start recording your conversation on a portable voice recorder (A good practice & aids to the other investigator, in case it has to be testified by other one)

2. Always follow an intuitive directory structure, before you initiate a new case for evidence & related work.

3. Always in advance sanitize all your forensic media

4. Keep an updated list of unique serial numbers of your forensic media (Thumb, pen, flash etc.)

5. Always carry your tool-kit while you are at action, no mistakes are allowed especially during the first three phases or you won’t be able to find the seeds of grain out of the chaff.

6. Always follow the rule being simple & honest while preparing the report after the analysis phase.

Please put your precious comments, So I can contribute more in an accurate way to our forensic community.

Thanks