Digital Forensics Readiness

Question 1

Why is Digital Forensics readiness important?

Answer 1

An unprepared organization runs considerable risks of ruining evidence before the investigation begins. An example would be an organization where there are no standard practices in place to ensure that evidence is gathered during incident response. Once the incident is handled, the users go back to using the system as normal, leading to loss of evidence integrity.

Question 2

What are the two main goals of Digital Forensic readiness?

Answer 2

The main objectives for forensic readiness are:

1. Maximizing the usefulness of the incident evidence data
2. Minimizing the cost of forensics during an investigation

Question 3

How may incident response and digital forensics have conflicting interests? How can this be addressed using forensic readiness?

Answer 3

The main purpose of incident response is to resolve unwanted situations inhibiting normal operations. The longer it takes to resolve an incident, the stronger the consequences (financial loss due to downtime, angry customers, etc). Resolving incidents as rapidly as possible will however leave no time for essential forensic procedures, e.g., disk and main memory imaging. The identification and collection of evidence must be conducted before the systems are tampered with (the incident being resolved).

The time required to collect the necessary evidence can be significantly reduced if the organization has clearly defined procedures detailing how it might be done in an efficient manner.

Question 4

What are some important standards for forensic readiness?

Answer 4

ISO/IEC (27037 and 17025)

NIST SP 800-86

Question 5

What are the primary objectives of LEA DF Readiness?

Answer 5

Law Enforcement Agency (LEA) digital forensics readiness is primarily concerned with:

1. Finding the evidence in a forensically sound manner.
2. Prioritize the evidence that is the most time critical (evidence which will vanish within a short period of time)

Question 6

What are the primary objectives for Enterprise DF Readiness?

Answer 6

This is primarily designed for businesses. The main objectives are:

1. Restore business operations as quickly as possible while complying with the law.
2. Preservation of evidence is important, but less than restoration of operations.