Understanding the forensic examination environment 

A term that has been pounded into my head since I first went to training with IACIS is the Forensically Sound Examination Environment. While it sounds complicated, it is a relatively simple concept:

• The digital forensic examiner controls the working environment of the digital forensic examination.  
• No actions will occur unless the digital forensic examiner intends the action to occur. 
• When the action has been completed, the examiner will reasonably know what the expected outcome is.

This concept does not merely apply to a physical location, but anywhere we complete a digital forensic examination or perform actions to support the digital forensic investigation. This could be a lab, office, or in the field where the digital evidence has been collected. 

The Forensically Sound Examination Environment is a mindset of the digital forensic examiner. You want to be methodical and thorough as...