Global Forensics Unit 3 Group Project, Research Paper Example

Part One

Introduction

During a forensic investigation, digital evidence is typically collected after an information security incident occurred. However, in order to prevent said incidents, many organizations have implemented systems which can gather and preserve digital evidence prior to the occurrence of an incident. This process is referred to as forensic readiness and gives organizations the ability to use digital evidence to its fullest potential while minimizing the cost of an investigation (Rowlingson, 2004).

Forensic Plan

Following are ten steps to implement a forensic plan and e-evidence acquisition strategy:

• Identify which areas of the organization will require digital evidence,
• Determine which sources are available while identifying various types of potential evidence,
• Establish the collection requirement for the evidence,
• Implement a system capable of gathering legally admissible evidence in a secure manner so that the process meets the legal requirement,
• Implement a policy which outlines the proper storage and handling of potential evidence,
• Ensure proper monitoring is established to identify and prevent major incidents,
• Identify which circumstances will require digital evidence in the event of a formal investigation,
• Implement proper staff training; especially for incident awareness,
• Record a case based on evidence by describing the incident and its impact, and
• Confirm legal review to expedite any action in response to the incident (Rowlingson, 2004, p. 9).

Part Two

Detailed Evidence Collection, Transport Procedures, and Preservation

Digital evidence is typically collected from emails, back-up discs, portable computers, telephone records, log files, and network traffic records. Evidence preservation and investigation time are typically affected by five factors: how logging is done; what specifically is being logged; intrusion detection systems; forensic attainment; and the manner in which evidence is handled (Radcliff, 2002). It is also important to note that a crime which took only 30 minutes to commit can take up to 48 hours to investigate. An effective forensic plan will give an organization the ability to maximize its use of digital evidence when required. Whenever it can support the legal process, digital evidence is implemented. In order to establish evidence collection procedures, preservation procedures, and transport procedures, the following steps should be implemented:

• Secure the scene: Do not allow any unauthorized personnel near the scene. Even personnel with the best of intentions could compromise the integrity and validity of the scene.
• Search the scene: Search the area surrounding the scene by collecting any evidence that may pertain to the crime; for instance, floppy discs and CD-ROMS. Photograph all items in situ before they are moved or labeled. Also, record all information pertaining to area searched by stating what was found, by whom, and when.
• Seize the evidence: Ensure that all components related to the area or computer being searched is confiscated. It is important to only group items together which were found together. All seized components should be recorded on Seizure Detail Forms.
• Post seizure: All seized components should be packed with care. In addition, all items should be transported with care. Furthermore, no seized items should be operated in any manner during transportation.
• Apply property and numbering scheme: All collected evidence in a computer forensic case is subject to a standardized numbering scheme.
• Custody: An accurate record should be kept of who has been and is handling the seized equipment. This will ensure a complete history of the journey of the evidence during the lifetime of the case.
• Control contamination: It is crucial that only a limited number of people have access to the seized evidence in order to prevent evidence contamination. All evidence should be stored in a secure area with complete documentation describing the contents (Department of the Premier and Cabinet, 2004).

Following these steps will ensure a proper investigation by maximizing the relevance of collected evidence and minimizing the threat of evidence contamination.

Works Cited

Department of the Premier and Cabinet. (2004). Forensic Plan. Retrieved June 26, 2011, from Office of e-Government: http://www.publicsector.wa.gov.au/SiteCollectionDocuments/forensic_plan.pdf

Radcliff, D. (2002, January 14). Forensic Detectives. Retrieved June 26, 2011, from www.computerworld.com: http://www.computerworld.com/s/article/67231/Forensic_Detectives?taxonomyId=010

Rowlingson, R. (2004). A Ten Step Process for Forensic Readiness. International Journal of Digital Evidence, 2(3), 1-28.