Computer forensics procedures, tools, and digital evidence bags: what they are and who should use them

This paper will try to demonstrate the importance of computer forensics by describing procedures, tools and differences in the use for individuals/small organizations vs. large organizations. The procedures described deal with how to collect evidence and the laws that need to be followed for admission of evidence into a court room. The tools used are the basis for all tools that are available. Tools include, backing up data, authentication, decryption, file auditing, IP tracking, and data recovery and document examination. Smaller organizations might use a variety of these or all of these. The discussion of larger organizations discusses the need for digital evidence bags (DEB) due to their extreme efficiency. A digital evidence bag is used to store information from various applications such as the tools mentioned above.

Download PDF