This digital duplicate becomes the version investigators use to explore the evidence without ruining it, and its importance is yet another reason why IT staffers should avoid tinkering when something dire occurs. Many investigators take the original hard drive and lock it in an onsite storage facility such as a closet or safe. The tools allow searches by keyword, file type or access date. Once experts have conducted an investigation, it can take weeks for them to make sense of everything they've found. Verification is the final step in the forensic process and usually ends with the preparation of a findings report that can be used in a court of law.
Documentation is key here.
Sean McCreight, CEO and chairman of Pasadena, Calif.-based Guidance Software, says investigators must be able to explain the methods they employ to uncover every byte of data. Because evaluation strategies differ, McCreight notes that this is the part of the forensic process that sets one investigator apart from another. It's one thing to have volumes of information in front of you. It's another thing to be able to dig in there, give everything some context and put it together in a way that everyone in a courtroom can understand. At Boeing, Motorola and others, for example, CIOs have hired squadrons of network security specialists to double as forensic investigators.