The following introduction was originally published in the BCS Information Security Now Magazine, Winter 2009 issue (Volume 3, Issue 2), which was on the topic of Computer Forensics:
“Digital forensics is an area overlooked by many companies – until needed. When required it can touch upon many business areas, including IT, HR and Legal. Proper planning can help ensure that it is effective when called upon.
Forensic Readiness
Companies should have a formal forensic readiness plan in place, so that when an incident occurs the correct skills, processes and technology are available to ensure proper collection of reliable evidence. This may require external resources being brought in to perform activities beyond, say, seizure or quarantining of a system or storage medium.It may also be sensible to limit untrained internal technical resources from engaging in digital forensics. They may overcompensate for having ‘permitted an incident to occur’ by being overly eager to respond and investigate, usually in a non-forensically sound manner. This would then undermine any disciplinary and legal proceedings.
As with any incident response and investigation, all those involved need to be skilled and knowledgeable practitioners in their field and follow clear procedures, such as the CPNI First Responder’s Guide and the ACPO Good Practice Guide for Computer-Based Electronic Evidence.
Future Forensics
I expect issues to develop with increasingly smart mobile devices, online / cloud / Web 2.0 services and storage, encryption, mass storage and anti-forensics tools. Emerging techniques such as live and remote forensics will continue to develop, to try and keep up with technology and the bad guys.”
A PDF version of the magazine is available online at: