Question

Please explain the steps you would take, from receipt of the evidence until testimony, including the reasons why you would take each step. For example, what would you check for when you sign for the drive on the chain of custody document?  

Answer 1

`Hey,

Note: If you have any queries related the answer please do comment. I would be very happy to resolve all your queries.

1.Before marking for the hard plate drive (HDD), I would check for indications of altering.

a.Evidence of altered or misused evidence can harm believability of evidence. ]

2.Check the Chain of Custody record for any irregularities, (Missing marks or unaccounted for time]

3.I would make documentation of evidence gathering process from the season of receipt of the HDD

4.Document the procedure and gear that I plan to use to extricate and examine digital evidence.

a.I will be asked how I gathered the evidence and be addressed on the off chance that it was in consistent with best practices.

5. Determine what sort of write blocker I would utilize.

a. Software write blockers are less demanding to transport, introduced on the imaging PC.

b.Hardware write blocker technology is less demanding to disclose to a layman. Might help in court declaration later on

Kindly revert for any queries

Thanks.