Should The Correct Procedures In Evidence Collection

Before any digital evidence is collected and analysed it is essential computer forensic investigators have a methodology in place. There are many different methodologies available such as DFRWS, ADAM and IDIP, to name a few. Although this chapter is discussing the correct procedures for evidence collection, it is important to remember the successfulness and effectiveness of evidence collection comes down to having a methodology in place. According to (Sansurooah, 2016), computer forensic analysts or specialists will follow clear, well defined methodologies and procedures, and flexibility is expected and encouraged when encountering with the unusual. It can be said methodologies provide guidance during the forensic process much like a compass gives a sense of direction to an explorer (Kuchta, 2002).

(InfoSec Institute, 2016)

CORRECT PROCEDURES IN EVIDENCE COLLECTION.
This chapter will discuss the correct procedures in evidence collection and will examine the ethics and Law surrounding digital forensic analysts. It is imperative ‘good procedures’ are followed because
investigations often fail due to mistakes made at a very early stage and essential digital evidence is ignored, destroyed or compromised (Sommer, 2013).
Before any investigation is authorised many questions needs to be answered such as; do we have the correct tools required, investigators appropriately qualified who have extensive knowledge and does the forensic team have the facilities to examine evidence. The ACPO guideline states that “Persons with inadequate training or unable to comply with the principles must not carry out the investigation” (Williams QPM, 2012). If during any part of the investigation the case gets complicated or beyond an investigator/analyses knowledge, it is expected the forensic investigator must either ask for “assistance from an experienced specialist investigator or undergo training in that particular field to enhance his or her
knowledge or skill base” (C H F I Computer Hacking Forensic Investigator, 2010). All of the above are important questions that the lead investigator has to answer, after all what’s the point assigning a case to an investigator if he/she has not been trained using tools which may be important to a specific case. When following a methodology one of the very first stages of the investigation is planning or alternatively known as preparation. The lead investigator will also authorise a team meeting which a number of topics will be discussed, this phase is conducted by the lead investigator who thoroughly briefs the whole team involved in the case. During the initial preparation stage all other documents are obtained. These documents include a search warrant’s, risk assessments and Laws to be followed. (FindReferenceStatingThis). At these very early stages of the planning stage it is critical examiners have the necessary equipment.
At the scene of the investigation it is mandatory for the success of the investigation and prosecution that these procedures are adhered and followed.