The Digital Forensics Process
Anders O. Flaglien · 2017
The digital forensics process can be used in criminal investigations, corporate investigations, or even private investigations. This chapter presents the process phases typically required to conduct an investigation of a crime or incident. As few crime cases involve electronic devices exclusively, the process needs to interact with traditional physical investigation practices in order to support an end-to-end criminal investigation. Typically, the digital forensics process begins with an observation, alert, or notification of an event or an incident related to a crime. Based on this, a hypothesis about the event or incident is made and the investigation process is initiated. The chapter presents the five phases of the digital forensics investigation process, based on the principles of digital forensics and common law enforcement and industry practices. It also looks into examples and scenarios that address how investigators work, or should work, and the tools they use.