{"id":1527,"date":"2017-05-04T17:38:35","date_gmt":"2017-05-04T17:38:35","guid":{"rendered":"http:\/\/ediscovery.drivesaversdatarecovery.com\/?p=1001"},"modified":"2026-03-09T02:58:47","modified_gmt":"2026-03-09T09:58:47","slug":"digital-forensics-process-identificationn","status":"publish","type":"post","link":"https:\/\/drivesaversdatarecovery.com\/ja-jp\/blog\/digital-forensics-process-identificationn\/","title":{"rendered":"Digital Forensics Process\u2014Identification"},"content":{"rendered":"

 <\/p>\n

By Rene Novoa, Senior Manager of eDiscovery and Digital Forensics<\/span><\/i><\/p>\n

Identification is an extremely important first step in the forensic examination process. It directly impacts efforts to develop a plan of action and ultimately the success of the project. It also allows the customer to control cost<\/a>. <\/span><\/p>\n

Identification<\/h2>\n

Before any digital forensic examination begins, the scope of actions must be identified. Who are the key players and custodians? What are the best sources of potential electronic evidence that will need to be accessed for collection? This information is needed for many reasons, including:<\/span><\/p>\n

    \n
  1. So that no essential evidence is missed that might affect a case<\/span><\/li>\n
  2. So costs can be estimated in advance and the scope of the case can be adjusted to fit actual needs<\/span><\/li>\n
  3. So potential sources of evidence identified later will have smaller impact in cost increases<\/span><\/li>\n<\/ol>\n

    \u30a4\u30f3\u30bf\u30d3\u30e5\u30fc<\/h2>\n

    Conducting interviews is a very important early step in a successful digital forensic examination. When determining relevant devices from which to collect data for a case, these individuals must be interviewed at a minimum:<\/span><\/p>\n

      \n
    1. Custodians<\/span><\/li>\n
    2. Site administrators<\/span><\/li>\n
    3. Users\u2014when available<\/span><\/li>\n<\/ol>\n

      Identify<\/h2>\n

      Look at the range of variables and determine what factors are at play in the case, including:<\/span><\/p>\n

        \n
      1. To what extent does legal authority exist to make a search?<\/span><\/li>\n
      2. Is there an administrator who can identify devices and custodians?<\/span><\/li>\n
      3. How many and what type of devices may be involved?<\/span><\/li>\n
      4. Are any peripheral devices involved, such as flash drives, printers, scanners or memory cards?<\/span><\/li>\n
      5. What types of electronically stored information (ESI) are potentially involved? It could be photographs, documents, spreadsheets, emails, text messages, databases and many other types of ESI.<\/span><\/li>\n
      6. How was ESI communicated and who was communicating? We may be looking for email addresses, text numbers, IP addresses and other similar information.<\/span><\/li>\n
      7. Has information been stored in an offsite location? On backup media? In the cloud? In remote locations?<\/span><\/li>\n
      8. Are there devices involved that have potential remote login capabilities?<\/span><\/li>\n
      9. What different operating systems may be involved?<\/span><\/li>\n
      10. Do any devices require continuous electric power to operate?<\/span><\/li>\n
      11. Other variables?<\/span><\/li>\n<\/ol>\n

        Document<\/h2>\n