Computer Forensics vs. Data Recovery
How is Computer Forensic Investigation different from Data Recovery Process?
Normally data recovery process does not concern the details of chain of custody of data media, acquiring of un-tampered data source and, examination of data for evidence etc.
In general, the computer forensic process will involve techniques to identify, acquire, examine, produce and verify digital evidence or information.
* Identify the scope of work, target object data through understanding of investigation cases
* Acquire the subject system or data seizure without tampering or unauthorized changes during the investigation and duplicate a copy if necessary. Recover any lost or deleted files necessary for the investigation. A proper chain of custody of object evidence should be kept.
* Examine acquired data including all lost, hidden, encrypted or temporary files.
* Produce detailed report with data case exhibits and impartial assessment of the information collected
* Verify and ensue reproducibility of findings It is essential that throughout the investigation, a full audit log of the investigation activities should be maintained and recorded. Such log may be called for as supporting documents subsequently.
Normally data recovery process does not concern the details of chain of custody of data media, acquiring of un-tampered data source and, examination of data for evidence etc.
In general, the computer forensic process will involve techniques to identify, acquire, examine, produce and verify digital evidence or information.
* Identify the scope of work, target object data through understanding of investigation cases
* Acquire the subject system or data seizure without tampering or unauthorized changes during the investigation and duplicate a copy if necessary. Recover any lost or deleted files necessary for the investigation. A proper chain of custody of object evidence should be kept.
* Examine acquired data including all lost, hidden, encrypted or temporary files.
* Produce detailed report with data case exhibits and impartial assessment of the information collected
* Verify and ensue reproducibility of findings It is essential that throughout the investigation, a full audit log of the investigation activities should be maintained and recorded. Such log may be called for as supporting documents subsequently.
