1 hour 49 minutes
module 2.2 is the next step in the process
that leads to expert testimony.
That's the evidence preservation phase. Once you've identified what needs to be collected and you ensure you have the proper authority to collect it now, you need to preserve the data.
The question is, how do you preserve the data?
Because this by far is the most important step
in the process being an expert witness
because it's the evidence preservation stage off the process that opens up the most issues for admissibility
and the most questions
from opposing experts and for opposing attorneys.
In this video, we're gonna cover the evidence preservation process. We'll talk about how to collect data, how data could be collected, what types of data could be collected or should be considered
when collecting data. There's a number of different ways and number of different types of data that you could collect.
If you're dealing with desktops, laptops or servers, you might
often go for a bit for bit forensic image, a full physical collection of every zero on one on the hard drive.
You could, however, choose to just collect a logical image of the files. A logical collection of just the active file data.
You could choose to collect just email data in the form of PST s or other email archiving formats.
You could talk about collection of mobile devices using celebrate or oxygen or X or Y, or a number of other tools that are out there.
If your servers air largely virtual, you might need to get a backup of the virtual servers into a V, M, D K. Or some other
You might also be talking about database backups, sequel database backups or other types of database backups.
You could be talking about cloud data, email or data that is stored in the cloud, not on a
local computer that you may need to download or collect or work with the
vendor to collect.
And don't forget also i o T devices. Apple watches,
smart thermostats, other devices that are part of the Internet of things that could be relevant to your matter.
In this video, we covered the evidence preservation process
and the different types of evidence that can be collected
and should be considered