Digital forensics methodologies and frameworks

Keeping in mind that forensics is a science, digital forensics requires that you follow appropriate best practices and procedures in an effort to produce the same results time and time again, providing proof of evidence, preservation, and integrity, which can be replicated if called upon to do so.

Although many individuals may not be performing digital forensics to be used as evidence in a court of law, it is best to practice DFIR in such a way as it can be accepted and presented in a court of law. The main purpose of adhering to best practices set by organizations specializing in digital forensics and incident response is to maintain the integrity of the evidence for the duration of the investigation. In the event that the investigator’s work must be scrutinized and critiqued by another or an opposing party, the results found by the investigator must be able to be recreated, thereby proving the integrity of the investigation...