Functional digital forensic investigation methodology

There are several different methodologies for conducting analysis. The following digital forensics investigation methodology is based on the best practices outlined in the NIST Special Publication 800-61a, which covers incident response, along with Dr. Peter Stephenson’s End-to-End Digital Investigations methodology. These two methodologies were further augmented by the research publication Getting Physical with the Digital Investigation Process by Brian Carrier and Eugene H. Spafford.

The overall approach to this kind of methodology is to apply digital evidence and analysis to either prove or disprove a hypothesis. For example, an analyst may approach the intrusion based on the initial identification with the hypothesis that the adversary was able to gain an initial foothold on the network through a phishing email. What is necessary is for the analyst to gather the necessary information from the infected system, endpoint...