Understanding the forensic examination environment
A term that has been pounded into my head since I first went to training with IACIS is the forensically sound examination environment. While it sounds complicated, it is a relatively simple concept:
- The digital forensic examiner controls the working environment of the digital forensic examination
- No actions will occur unless the digital forensic examiner intends the action to occur
- When the action has been completed, the examiner will reasonably know what the expected outcome is
This concept does not merely apply to a physical location, but anywhere we complete a digital forensic examination or perform actions to support the digital forensic investigation. This could be a lab, office, or in the field where the digital evidence has been collected.
The forensically sound examination environment is a mindset of the digital forensic examiner. You want to be methodical and thorough to support the digital...
