Society and Ethics in IT · Unit 5
Digital Forensics and Investigation
Exam-focused notes for Digital Forensics and Investigation (Society and Ethics in IT, BIT358): what the TU syllabus asks and how it has actually been tested, with 2 solved past questions from this unit.
What this unit covers
- Computer forensics investigation procedures
- Digital evidence preservation techniques
- Digital evidence analysis methods
- Investigation report documentation
- Documents included in forensic reports
- Legal considerations in digital investigation
Documents included in forensic reports
Why is investigation report needed? What different documents are included in this report? [5]
An investigation report is needed for the following reasons: 1. Documentation of Findings: It provides a formal, written record of all findings discovered during the investigation process, ensuring nothing is overlooked or forgotten. 2. Evidence Preservatio...
Full solved answer →Digital evidence preservation techniques
How do you preserve and analyze digital evidence in computer crime? Explain. [5]
Chain of Custody - Maintain a documented record of who handled the evidence, when, and for what purpose - Prevents tampering claims and ensures admissibility in court - All transfers must be logged with signatures and timestamps Imaging and Backup - Create ...
Full solved answer →Make Unit 5 stick
Practice BIT358 with flashcards & quizzes