Evidence gathering strategy and method
*The step by step process of how to handle an evidence, exp making a copy,
hashing it*
Firstly, the parties involved in this incident must be identified, in our case, the
parties involved consist of Bruce Armiter and the highest bidder for the CF card.
After receiving the CF card from the company, the first step is to perform a hash
function by using hashing software such as Hash Tool or HashMyFiles on the CF
card to be used as an evidence in a later stage to show that the CF card has not
been modified in any way during the process from identifying the CF card to
showing it as an evidence in court. Before analyzing the CF card, the CF card’s
data needs to be preserved by duplicating it to prevent evidence contamination
during the analyze process. Duplication of data can be performed by using Win32
Disk Imager. After that, data recovery needs to be performed on the duplicated
data to recover any deleted data that might be useful to the investigation. After
that, the duplicated data needs to be filtered to identify data that are more
relevant to the case. After that, the extraction and analyzation of CF card’s data
can be performed by using EnCase.