Digital forensic process: Difference between revisions

Revision as of 22:20, 27 November 2019

Revision as of 10:28, 5 March 2020

Line 1:

[[File:Forensic tableau.JPG|thumb|right|A Tableau forensic write blocker]]

The '''digital forensic process''' is a recognized scientific and forensic process used in [[digital forensics]] investigations.<ref name="first" /><ref name="handbook" /> Forensics researcher [[Eoghan Casey]] defines it as a number of steps from the original incident alert through to reporting of findings.<ref name="casey" /> The process is predominantly used in [[Computer forensics|computer]] and [[Mobile device forensics|mobile]] forensic investigations and consists of three steps: ''acquisition'', ''analysis'' and ''reporting''.

Digital media seized for investigation is usually referred to as an "exhibit" in legal terminology. Investigators employ the [[scientific method]] to recover [[digital evidence]] to support or disprove a hypothesis, either for a [[court of law]] or in [[civil litigation|civil proceedings]].<ref name="handbook" />