Forensic Investigative Process for Situational Awareness in Information Security

Abstract

As a starting point for the development of a common visualization of the forensics process by the members of an investigating team, this chapter provides algorithms that provide guidance and step by step instructions on how to deal with computer forensics and the investigations they carry out. A general introductory overview of computer forensics is provided, and the framework of a forensic investigation is summarized. On the basis of this framework, three algorithms are provided, one for each phase of a forensic investigation, which cover the different aspects of computer forensics and address key elements to be considered when attacked systems are investigated.