Tool validation
Earlier, we discussed potential attacks on you, your exam, and your findings. The opposing counsel will focus on how you did the exam and what tools you used to perform the exam. Your ability to mitigate the opposing counsel attacks is directly related to your preparation and the documentation you created during the exam. Being aware and following best practices is critical in your ability to defend your actions successfully. How do you do this? By continuing your education. The field is constantly changing, and you must keep aware of those changes.
The level of detail can easily overwhelm new digital forensic investigators as they need to know how to successfully mitigate the opposing counsel’s attack. While you need not know the specific programming or code a particular tool uses, you need to know where the artifact found by the tool is located within the filesystem/operating system so you can adequately explain it as you testify or create your report...
