Case Response 3
This first step in the computer examination is to understand where data exists, what
conduct is at issue, what the aim of the investigation is and what output is sought. The most
effective place to begin a computer forensic investigation is to consult with client to create a
strategy for collecting, analyzing and processing the data.
This strategy may include analysis of
where the critical information exists, as well as the identification of protocols that will ensure the
admissibility of the data into evidence in a court of law, should it become necessary (Wall &
Paroff, 2005). ”The seriousness of the matter and the sophistication of the perpetrator(s) will
have the largest impact on the approach taken” (Hopwood, Leiner, & Young, 2008, p.172). In
addition, before any investigation begins, the investigator should ensure that he/she has the
proper legal authority to seize, copy, and examine the data, and is not invading someone’s
privacy without authorization (Hopwood, Leiner, & Young, 2008). Generally, “corporations and
business owners can give permission to inspect items under their ownership and control, but
some exceptions exist” (Hopwood, Leiner, & Young, 2008, p.171).