Free Trial

Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

Share this Page URL

4.3 Summary of Best Practices > 4.3.1 Volatile data and live forensics - Pg. 26

26 CHAPTER 4 The Foundations of Digital Forensics: Best Practices 4.2 WHO SHOULD BE FOLLOWING BEST PRACTICES? Anyone who proposes to work as a computer or digital forensics examiner should always follow the established best practices in the field. This is vitally important in a field where the results of the examiner's actions are to be used to provide evi- dentiary findings based on the collection, preservation, and analysis of evidence. Failing to follow accepted best practices leaves the work of the forensic examiner open to challenge and the possibility of the evidence collected being suppressed. The very least of the results of failing to adhere to accepted minimal best practices in the collection and preservation of evidence can be to cast doubt on the skills and qualifications of the examiner and the entirety of the examiner's work and potential testimony. It is also highly likely that an examiner will be questioned about these best practices when testifying in court. 4.3 SUMMARY OF BEST PRACTICES Best practices apply to the collection and preservation of evidence. These are