Computer Forensics Foundation — Lesson 2: Evidence Identification, Collection, Imaging, Hashing, Preservation, and Documentation

Learning Objectives

• Interpret the principles, requirements, roles, and dependencies shaping evidence identification, collection, imaging, hashing, preservation, and documentation.
• Apply a repeatable workflow and produce a reviewable acquisition and integrity worksheet.
• Evaluate normal operations, the exception where review actions related to documentation remain overdue or unverified, and appropriate follow-up actions.

Detailed Topics

• Evidence Identification within the context of Computer Forensics Foundation.
• Collection within the context of Computer Forensics Foundation.
• Imaging within the context of Computer Forensics Foundation.
• Hashing within the context of Computer Forensics Foundation.
• Preservation within the context of Computer Forensics Foundation.
• Documentation within the context of Computer Forensics Foundation.

Instructor Demonstration

The instructor traces a realistic case involving an investigation team examining endpoints, removable media, user activity, and system artifacts after a suspected security incident. The demonstration shows how to define scope and criteria, collect evidence, record decisions in acquisition and integrity worksheet, and challenge the condition where review actions related to documentation remain overdue or unverified.

Hands-On Exercise

Complete a controlled exercise for Evidence Identification, Collection, Imaging, Hashing, Preservation, and Documentation. Establish responsibilities and acceptance criteria, examine the case where review actions related to documentation remain overdue or unverified, reach a supported conclusion, and preserve the result in acquisition and integrity worksheet.

1. Confirm the objective, scope, roles, criteria, and expected work product.
2. Perform the activity while recording assumptions, evidence, and decisions.
3. Test a normal case, the stated exception, and a follow-up condition.
4. Document conclusions, ownership, deadlines, escalation, and verification requirements.

Scenario Analysis

• Identify the requirement, principle, or control with the strongest influence on evidence identification, collection, imaging, hashing, preservation, and documentation.
• Compare two defensible responses and explain their operational, risk, and evidence trade-offs.
• Determine how acquisition and integrity worksheet should be approved, retained, reviewed, and updated.

Troubleshooting Guidance

Begin with the earliest point where expected practice and observed evidence diverge. Separate a missing record from an ineffective process, and distinguish role ambiguity from a control or competence failure. Treat “review actions related to documentation remain overdue or unverified” as a hypothesis until the response is tested against the applicable criteria and intended outcome.

Validation Checklist

• The scope, roles, criteria, stakeholders, and intended outcome for evidence identification, collection, imaging, hashing, preservation, and documentation are explicit.
• The acquisition and integrity worksheet connects conclusions to objective, reviewable support.
• Normal operation, the stated exception, escalation, and follow-up were evaluated.
• Owners, due dates, verification methods, review triggers, and improvement actions are clear.

Lesson Outcome

Learners can apply Evidence Identification, Collection, Imaging, Hashing, Preservation, and Documentation, explain the reasoning used, and defend the result through acquisition and integrity worksheet.