Reference no: EM133855878

Before gathering or assessing any of the data, computer forensics investigators must first determine the scope of the investigation to identify what steps must be taken. This includes notifying authorities and obtaining necessary authorization to conduct an investigation. Next, the investigator should review any applicable policies and regulations that pertain to the situation and the expected actions the investigator could take. Once this is accomplished, the investigator should assemble a team based on the speed and talents required to execute the investigation. Next, the investigator should evaluate the situation and entities involved to determine what sensitivities must be applied. For example, certain precautions may be necessary to protect private financial or health data, proprietary information, or intangible impacts to the subjects of the investigation or their connections. Lastly, the investigator should prepare to gather the evidence. This includes assessing the network topology to help guide the investigation team and provide insights into where it may need to look for further evidence. It is also beneficial to speak with network or system administrators and third-party vendors who either had access to or provided services to the network. Such information helps set expectations for the investigative team to determine what is expected and what may be outside normal activity (Pande et al, 2021).

Failing to adequately prepare for an investigation may result in the investigation taking far longer than desired, particularly if investigators need to gain additional authorizations to carry out the investigation or if additional equipment needs to be procured. Some of these situations may be unforeseen or unavoidable, but they can be mitigated through proper planning. Furthermore, failing to prepare may also result in steps being missed in the process or not following standards of practice that may impact the results of the investigation or cause the investigators' testimony to be dismissed in court.