Forensic Acquisition
Essentials
Just as crime scene investigators carefully gather physical evidence,
Computer Forensics Acquisition professionals methodically, safely, and
securely acquire electronic evidence in a manner that preserves the data and
maintains the chain of custody. This may involve creating a forensic backup
of a system or network in cases where the equipment cannot be taken offline;
or physically acquiring the equipment. For each piece of evidence, Chain of
Custody forms, host records, and imaging logs are produced.
All evidence is hashed to ensure two things:
- Images match original data
- Images of backup data are identical
Evidence is transported within approved standards, and stored within a
secure holding facility.
Benefits
In the event of a breach, theft, or inappropriate employee behavior, it
is absolutely crucial that electronic evidence be preserved. Why? Because
electronic evidence contains the information needed to understand three
things:
- How the events happened
- How to mitigate the cause of the events
- What data or resources may have been affected by the breach or
theft
It is essential that electronic evidence be acquired in a methodical,
safe, and secure manner, and preserved in a manner that is admissible in
a court of law.
Expertise
SecureState’s Readiness and Response Team is comprised of industry
experts with experience in Military Intelligence, Law Enforcement, and Big X
Consulting; and includes members with high-level government clearances.
Members of our Team have been involved in the acquisition and forensic
analysis of data in high profile events including the Space Shuttle Columbia
Disaster. They have coordinated Incident Response teams that included FEMA,
AFCERT, and DHS against inclement weather, terrorist activities, and
world-wide threat events. Several members of the Team have high-level
government security clearances and are trusted with the nation’s most
classified secrets. With unimpeachable ethical standards and unsurpassed
technical skills, SecureState’s Readiness and Response Team is ready to
assist with even the most complex businesses’ information security readiness
and response.
Did You Know?
- Forensic acquisition principles and
methodologies are not just for incidents that may go
to trial
- Any investigation on systems or devices affect
evidence and therefore the accuracy of the analysis
- Forensic acquisition techniques ensure the
integrity of the collected data and investigation.
- Forensic methodologies may be required and
driven by regulatory guidelines such as PCI, PHI and
privacy laws.
- Forensic acquisition, tracking, management and
validation should be included within the
organization’s incident procedures and policies
- Forensic procedures and policies should have
annual testing and exercises.