Please enable JavaScript.

Coggle requires JavaScript to display documents.

Week 9 Forensics (Report Findings (Assumptions and considerations…

- - - - Clear & standardized way of expressing
      - Just presentation of the evidence
      - Use a standard 7 grade scale
  - - - Size of disk
      - Partitions
      - OS versions
      - Users
      - Time zones
      - Network drives
  - - - Describe the investigation
      - Include
        
        Name of who ordered examination
        
        ID of the investigation
        
        Evidence ID
      - Maintain chain of custody
    - - What to expect
      - Focus points
      - Questions we want answered
    - - Pieces of evidence found during exam
      - Presented in an objective manner
      - Don't make any interpretations yet
    - - Interpretations
      - Not everyone agrees
      - Followed by wordlist