Principles and models of a forensic investigation

Question 1

What are the steps in McKemmish model?

Answer 1

1. Acquisition
2. Preservation
3. Examination
4. Analysis
5. Presentation

Question 2

What is the Daubert standard?

Answer 2

Defines principles for the testimony of the expert to be admissible in the court of law

Question 3

Which are the principles described in Dauberts standard?

Answer 3

• Judge is a gatekeeper: trial judge will decide the admissibility of the evidence by expert, judge will make sure that the testimony is deeply rooted in the scientific knowledge
• Relevant : the judge makes sure that the evidence is relevant to the fact in issue
• Reliable : the methods and the techniques used by the expert are reliable and reliably applied to the fact in hand
• Scientific knowledge :

Question 4

Explain scientific knowledge

Answer 4

• it is based on empirical review and testing
• it is based on the peer review published work, –the potential error rate is known,
• it is subject to standards controlling its application
• it is generally accepted by the relevant scientific community

Question 5

Which 4 types of analysis is there?

Answer 5

1. Relational
2. Functional
3. Temporal
4. Forensic analysis

Question 6

Explain Relational analysis

Answer 6

Geographic locations, communication and interconnections among different entities/actors

Question 7

Explain Functional analisys

Answer 7

Configuration and the state of the system in the time of crime, malware analysis and engineering

Question 8

Explain Temporal analysis

Answer 8

Timeline of the events, identify the dynamics or the intensity of the activities and to identify patterns of behavior

Question 9

Explain forensic analysis

Answer 9

Providing crucial evidence while dealing with complexity that the actors behind the evidence create.

• seeking : what happened
• Linkage : the extent and the relations of interactions
• Source evaluation : sources and were they came from
• Attribution : allocation of responsibilities

Question 10

When you talk about source evaluation, there are 4 categories of evidence, which?

Answer 10

1. Produced by a source : production
2. A segment of a source : possibly from more evidence that have med fragmented
3. Altered by the source
4. Just an isolated piece of evidence

Question 11

When recovering deleted data, which two objectives are there?

Answer 11

1. Salvage and preserve all the digitally stored data

2. Transform what is unreadable or unintelligible into readable and meaningful

Question 12

Qualification must reflect the level of confidence the examiner has in the evidence, how do you scale it?

Answer 12

By the certainty scale or the degrees of likelihood (almost certain, most probably, probably, very possibly and possibly)