3. Image and hash—When digital evidence is found,
it should be carefully duplicated and then hashed to
validate the integrity of the copy.
4. Validate tools—When possible, tools that are used for
forensics should be validated to ensure reliability and
correctness.
5. Analyze—Forensic analysis is the execution of
investigative and analytical techniques to examine the
evidence.
6. Repeat and reproduce (quality assurance)—The
procedures and conclusions of forensic analysis
should be repeatable and reproducible by the same or
other forensic analysts.
7. Report—The forensic analyst must document his/
her analytical procedure and conclusions for use by
others.
8. Possibly present expert testimony—In some cases,
the forensic analyst will present his/her findings and
conclusions to a court or another audience.
The process involves more than intrusion-related security
incidents. Zatyko defines scientific digital forensics as:
“The application of computer science and investigative
procedures for a legal purpose involving the analysis of
digital evidence after proper search authority, chain of
custody, validation with mathematics, use of validated tools,
repeatability, reporting, and possible expert presentation.”23
As the process steps indicate, the digital forensic analyst
meticulously handles, analyzes and reports on the evidence
obtained, to present an objective opinion on the facts of a
case without prejudice