Revisiting risk sensitive digital evidence collection

Over the past decade or so, well-understood procedures and methodologies have evolved within computer forensics digital evidence collection that emphasized disk imaging procedures. In their paper Risk Sensitive Digital Evidence Collection [3], the authors posit that the current methodology which focuses on collecting entire bit-stream images of original evidence disk could increase legal and financial risks. The authors go on to state that the rapidly increasing and changing volume of data within corporate network information systems and personal computers is driving the need to revisit current evidence collection methodologies. No assertion is made in the foundation paper that current methodologies are no longer valid; moreover it is presented that in some situations selective evidence extraction could be accomplished while still ensuring reliability, completeness, accuracy, and verifiability of computer disk evidence.

Download PDF