Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
Already have an account? Sign In »
1 hour 49 minutes
less than 3.1 is titled Investigation Planning.
It's really important when you set out to start doing analysis
that you have a plan that you have a
path that you're gonna follow, or at least a starting point that you're gonna follow in order to
move forward. Because otherwise you may be feeling overwhelmed. You may think that you're looking for a needle in a haystack.
You may not have a
defined, repeatable, defensible process. If you don't play in
in this video, we're gonna talk about how and why to establish an investigation plan.
I love this quote from Mike Tyson because it really shows and really articulates what it's like to be in forensics and to put together an investigation plan without really having done any analysis. And that is, everyone has a plan until they get punched in the mouth.
You know, it's important to understand that your plan, while you are developing it
while you're going to try to abide by it,
is going to change, not may. It's going to change. You're gonna find a piece of evidence that's gonna lead, or finding that's gonna lead you down either a rabbit hole or lead you down, a path you didn't initially plan on. You've drawn your hypothesis, that scientific hypothesis
that you've then gone toe look for
and your hypothesis being based on whatever this thief
facts of the case are, or the
hiring attorney believes are the
facts of the case. And you might find that the facts of the case when you start seeking the truth end up being totally different.
So it's always good to have a plan. It's always important to have a plan. You should definitely create a plan, but you need to be prepared that your plan's gonna change
again. You're planning
needs to be scientific. You need to follow the scientific method
that you learned about in school.
You need to generate a hypothesis. Start looking into that hypothesis
based on the results. You may then go back and ultimately change your hypothesis. You may prove you and you may go through this in an iterative process. You may do it a couple of times.
You have to make sure that however
scientific and whatever your hypothesis might be, that it's that the process you follow is repeatable by documenting it by documenting what you did.
It makes it easier to repeat the process six months, eight months, 12 months down the line. Or if you have to hand off the process to somebody else and have them review,
or if you're handing it to the other side and they're going to review the process. You wanna make sure that your processes repeatable
when I mix one hydrogen atom with two oxygen atoms,
I get a Choto, too.
When I mix
two hydrogen atoms with one oxygen atom,
I get Htoo. I get water.
It's very important that
my process be repeatable.
It also needs to be logical.
It needs to follow
in a path that makes sense.
You're not gonna simply just start poking around on the hard drive. You're going to start by walking through the process, you might say.
if this is a case involving
theft of money
you might look at
something different than
if it's a process
that is looking for
But you want to follow a logical process.
Logical process, if you're searching for ***,
is probably not to start reviewing word documents.
It's to review the graphics on this system
by doing a By creating a repeatable and logical process, you increase the defense ability of the process.
And remember that defense ability is a key key
and foundational concept in forensics.
And as we said, everyone's got a plan until they get punched in the mouth.
So you've got to be adaptable. You've gotta be prepared that your plan may go awry and you may have to start looking at things you didn't initially planned to look at. Based on the evidence presented to you
in this video, we covered how and why to establish an investigation plan.