Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.
-
Upload
marco-harding -
Category
Documents
-
view
225 -
download
0
Transcript of Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.
![Page 1: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/1.jpg)
Practical Application of Practical Application of Computer Forensics Computer Forensics
Lisa Outlaw, CISA, CISSP, CRMALisa Outlaw, CISA, CISSP, CRMA
![Page 2: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/2.jpg)
OverviewOverview Definition of Computer ForensicsDefinition of Computer Forensics Computer Forensics & AuditingComputer Forensics & Auditing Why We Need Computer Forensics Why We Need Computer Forensics The Process (Do’s & Don’ts)The Process (Do’s & Don’ts)
IdentificationIdentification Collection of EvidenceCollection of Evidence Required DocumentationRequired Documentation ImagingImaging ExaminationExamination Report PreparationReport Preparation Returning of EvidenceReturning of Evidence
![Page 3: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/3.jpg)
Definition of Computer ForensicsDefinition of Computer Forensics
Computer forensics involves the: Computer forensics involves the: IdentificationIdentification CollectionCollection PreservationPreservation Examination, and Examination, and Analysis of digital informationAnalysis of digital information
Digital Information becomes Digital EvidenceDigital Information becomes Digital Evidence
![Page 4: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/4.jpg)
What is Digital Evidence?What is Digital Evidence?
Digital evidence is any information of value Digital evidence is any information of value that is either stored or transmitted in a that is either stored or transmitted in a binary form, including digital audio, image, binary form, including digital audio, image, and video.and video.
![Page 5: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/5.jpg)
Computer Forensic ExaminationComputer Forensic Examination
The Computer forensic examination The Computer forensic examination is:is:
Locating digital evidence Locating digital evidence Evidence can withstand close Evidence can withstand close
scrutiny or a legal challenge. scrutiny or a legal challenge.
![Page 6: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/6.jpg)
Computer Forensics & AuditingComputer Forensics & Auditing Computer forensics can support your audit Computer forensics can support your audit
and investigation objectives:and investigation objectives: An Effective System of Internal Controls; An Effective System of Internal Controls; Reliability of Financial Reporting;Reliability of Financial Reporting; Compliance with federal and state laws;Compliance with federal and state laws; Detection of Fraud, Waste, and Abuse Detection of Fraud, Waste, and Abuse
![Page 7: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/7.jpg)
Audit of Travel ExpensesAudit of Travel Expenses
Planning PhasePlanning Phase Used an audit program Used an audit program
customized to my customized to my specific environment specific environment and risks assessedand risks assessed
Gained access to Gained access to Travel expense data Travel expense data and appropriate and appropriate analysis tools, such as analysis tools, such as ACL•ACL•
Gain an Gain an UnderstandingUnderstanding
Gain an Gain an Understanding of the Understanding of the business processes, business processes, including procedures including procedures for approving, for approving, recordingrecording
and reimbursing and reimbursing expensesexpenses
![Page 8: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/8.jpg)
Audit of Travel ExpensesAudit of Travel Expenses
Considered Red Flags (Risks Assessment)Risks Assessment)
Most Frequent Travelers Falsified or manipulated receipts Claims for meals or mileage only Inflated mileage totals on personal car usage
![Page 9: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/9.jpg)
Audit of Travel ExpensesAudit of Travel Expenses
You select the most frequently reimbursed You select the most frequently reimbursed employee by summarizing the travel employee by summarizing the travel expenses.expenses.
You then obtain supporting evidence to You then obtain supporting evidence to determine if the travel actually occurred, is determine if the travel actually occurred, is overstated or understated, accurate, overstated or understated, accurate, classified correctly in the financial classified correctly in the financial statements, etc..statements, etc..
![Page 10: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/10.jpg)
Audit of Travel ExpensesAudit of Travel ExpensesProfessional SkepticismAn attitude that includes a questioning mind An attitude that includes a questioning mind and a critical assessment of audit evidence. and a critical assessment of audit evidence. The auditor should not assume that The auditor should not assume that management is either honest nor dishonest. management is either honest nor dishonest.
Computer Forensics ExaminationLocating digital evidence that can withstand Locating digital evidence that can withstand close scrutiny or a legal challenge. close scrutiny or a legal challenge.
![Page 11: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/11.jpg)
Audit of Travel ExpensesAudit of Travel Expenses
Request the services of a computer Request the services of a computer forensics expert to analyze the employees’ forensics expert to analyze the employees’ hard drive to determine if digital evidence hard drive to determine if digital evidence can be found to support the falsification of can be found to support the falsification of the travel reimbursement form.the travel reimbursement form.
![Page 12: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/12.jpg)
Audit of Travel ExpensesAudit of Travel Expenses Computer Forensic Results:Computer Forensic Results:
Digital evidence proved this employee did not travel at all.Digital evidence proved this employee did not travel at all. EmailsEmails Telephone calls Telephone calls made from within the building using VOIPmade from within the building using VOIP Facility access logs Facility access logs proved the employee was in the proved the employee was in the
building during the days he was supposed to be on travel building during the days he was supposed to be on travel status. status.
A A signature block signature block of the supervisor was found, on the of the supervisor was found, on the employees hard drive.employees hard drive.
Hash values of the signature image Hash values of the signature image agreed with the hash agreed with the hash value of the signature image used on the fraudulent travel value of the signature image used on the fraudulent travel reimbursements. reimbursements.
![Page 13: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/13.jpg)
Audit of Travel ExpensesAudit of Travel Expenses
Travel Reimbursement FraudTravel Reimbursement Fraud More than $100,000 of fraudulent More than $100,000 of fraudulent
reimbursements were found made to this one reimbursements were found made to this one employees.employees.
Are our internal controls over travel Are our internal controls over travel expenditures weak or strong?expenditures weak or strong?
Control Weaknesses found:Control Weaknesses found: Staying with Friend and Family (Produce no Staying with Friend and Family (Produce no
receipts)receipts)
![Page 14: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/14.jpg)
Why We Need Computer Forensics Why We Need Computer Forensics ((Reasons for Computer Forensic Services)Reasons for Computer Forensic Services)
Inappropriate Use of Computer SystemsInappropriate Use of Computer Systems Determining a Security BreachDetermining a Security Breach Detection of Disloyal Employees Detection of Disloyal Employees Evidence for Disputed DismissalsEvidence for Disputed Dismissals Malicious File Identification Malicious File Identification Theft of Information AssetsTheft of Information Assets Forgeries of DocumentsForgeries of Documents
![Page 15: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/15.jpg)
The ProcessThe Process
(1)(1)IdentificationIdentification
(2)(2)Collection of EvidenceCollection of Evidence
(3)(3)Required DocumentationRequired Documentation
(4)(4)ImagingImaging
(5)(5)ExaminationExamination
(6)(6)Report PreparationReport Preparation
(7)(7)Returning of EvidenceReturning of Evidence
![Page 16: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/16.jpg)
IdentificationIdentification
AUDITOR’S ROLEAUDITOR’S ROLE
(Forensic Specialist)1. Determine if reason for
computer forensics is appropriate.
2. Identify where additional digital evidence may reside.
AUDITEE’S ROLEAUDITEE’S ROLE
(ex. University)1. Determine when to use
Computer Forensic Services:
2. Identify where digital evidence may reside.
![Page 17: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/17.jpg)
Collection of EvidenceCollection of Evidence
• IT AUDITOR’S ROLE– Help Client Secure the
computer to be examined
– Require and Complete Necessary Forms
– Securely Collect Computer from Client
• AUDITEE’S ROLE– Ensure that computer
to be examined remains secure until collected
– Notify Appropriate Personnel
– Complete Chain of Custody Form
![Page 18: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/18.jpg)
Collection of Evidence – Collection of Evidence – (Do's & Don'ts)(Do's & Don'ts)
Do not disturb the computer in question. Do not disturb the computer in question.
![Page 19: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/19.jpg)
Computer is off, Leave it offComputer is off, Leave it off
Collection of Evidence – Collection of Evidence – Do's & Don'tsDo's & Don'ts (con’t) (con’t)
![Page 20: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/20.jpg)
Computer is on, Leave it onComputer is on, Leave it on
Collection of Evidence – Collection of Evidence – Do's & Don'tsDo's & Don'ts (con’t) (con’t)
![Page 21: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/21.jpg)
Do not run any programs on the Do not run any programs on the computer.computer.
Collection of Evidence – Collection of Evidence – Do's & Don'tsDo's & Don'ts (con’t) (con’t)
![Page 22: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/22.jpg)
Do not make any changesDo not make any changes
Collection of Evidence – Collection of Evidence – Do's & Don'tsDo's & Don'ts (con’t) (con’t)
![Page 23: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/23.jpg)
Do Not Insert Anything Into The Do Not Insert Anything Into The ComputerComputer
Collection of Evidence – Collection of Evidence – Do's & Don'tsDo's & Don'ts (con’t) (con’t)
![Page 24: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/24.jpg)
Secure the computerSecure the computer
Collection of Evidence – Collection of Evidence – Do's & Don'tsDo's & Don'ts (con’t) (con’t)
![Page 25: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/25.jpg)
Required DocumentationRequired Documentation
Computer Forensic Request Form Computer Forensic Request Form
Chain of Custody FormChain of Custody Form
Signatures Signatures
Disclosures and Disclaimers Disclosures and Disclaimers
![Page 26: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/26.jpg)
Required DocumentationRequired Documentation
![Page 27: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/27.jpg)
Required DocumentationRequired Documentation
Auditor’s Role Assign a Case Number
Assign an auditor or
computer forensic expert
Date & Time When device was secured
AUDITEE’S Role Document Date & Time
of Request Name of Requestor Date & Time Client
secured the device Agency Name Head of the Agency
Name
![Page 28: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/28.jpg)
Required DocumentationRequired DocumentationAuditor’s Role Document: Serial Numbers Mac Address -Static IP
Address Make & Model
AUDITEE’S RoleDocument: Reason For Request Desired Objectives
![Page 29: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/29.jpg)
Approval From Relevant Parties Approval From Relevant Parties
Approvals should be obtained from:Approvals should be obtained from: Head of the Agency or CompanyHead of the Agency or Company Audit DirectorAudit Director Legal Counsel, and Legal Counsel, and Human Resources Human Resources
![Page 30: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/30.jpg)
AUDITOR’S Role Sign and Date form Obtain Director and
Legal Counsel approval
AUDITEE’S Role Sign and Date form Obtain Agency Head
Approval
Required DocumentationRequired Documentation
![Page 31: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/31.jpg)
Additional Chain of Custody Form
Chain of Custody form continued on the reverse side of the computer forensic request form.
Device Serial#
FAS
Make Model
Signature Print Name
Reason Date Time
Relinquished By:
Received By:
![Page 32: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/32.jpg)
Why Are These Documents Why Are These Documents Necessary?Necessary?
Collect important informationCollect important information Legal AspectsLegal Aspects
Get out of jail free cardGet out of jail free card
![Page 33: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/33.jpg)
Scan HardcopiesScan Hardcopies
We scan all hardcopy forms to PDF and this electronic We scan all hardcopy forms to PDF and this electronic copy is kept with the images of the evidence.copy is kept with the images of the evidence.
![Page 34: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/34.jpg)
ImagingImaging
AUDITOR’S ROLEAUDITOR’S ROLE– Determine where to
perform the image:– Onsite
– In the Lab
AUDITEE’S ROLEAUDITEE’S ROLE– escort our staff to
physically collect the computer from the computer’s secure location.
![Page 35: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/35.jpg)
Hardware Imaging
![Page 36: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/36.jpg)
ImagingImaging Here are some of the procedures we use Here are some of the procedures we use
during imaging to ensure that evidence during imaging to ensure that evidence collected is clearly identified and preserved:collected is clearly identified and preserved:
![Page 37: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/37.jpg)
Tag EvidenceTag Evidence
We manually tag all evidence items with an We manually tag all evidence items with an assigned case number using the following naming assigned case number using the following naming convention:convention:
Case Number and Hard Drive Serial Number Case Number and Hard Drive Serial Number (Ex., 01-2008-04-Agency Name – HDD Serial#)(Ex., 01-2008-04-Agency Name – HDD Serial#)
![Page 38: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/38.jpg)
Connect Hard drive to Write BlockerConnect Hard drive to Write Blocker
![Page 39: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/39.jpg)
Connect Write Blocker to Connect Write Blocker to the hard drivethe hard drive
![Page 40: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/40.jpg)
Imaging Regular Hard DriveImaging Regular Hard Drive
To image a regular sized To image a regular sized hard drive, implement hard drive, implement the following procedures:the following procedures: Request the client to Request the client to
purchase a storage device. purchase a storage device. Reduces CostReduces Cost Ensure enough space is Ensure enough space is
available to process the available to process the evidence. evidence.
Easy transfer of images to Easy transfer of images to clientclient
![Page 41: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/41.jpg)
Storage DeviceStorage Device
•
![Page 42: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/42.jpg)
Organize Evidence InformationOrganize Evidence Information Create the following folders on the Create the following folders on the
destination drive for every case:destination drive for every case: Case Name-Evidence Item Number (Folder)Case Name-Evidence Item Number (Folder)
1.1. Evidence (sub-folder)Evidence (sub-folder)1.1. HDD1 (sub-folder)HDD1 (sub-folder)2.2. HDD2 (sub-folder)HDD2 (sub-folder)
2.2. Export (sub-folder)Export (sub-folder)3.3. Temp (sub-folder)Temp (sub-folder)4.4. Index (sub-folder)Index (sub-folder)5.5. Drive Geometry (sub-folder)Drive Geometry (sub-folder)6.6. Report (sub-folder)Report (sub-folder)7.7. Case Back-up (sub-folder)Case Back-up (sub-folder)
Place all images produced in the Evidence Folder
![Page 43: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/43.jpg)
Use FTK Imager Use FTK Imager Create the image using FTK imagerCreate the image using FTK imager
Through experience, we have found this to be one of the Through experience, we have found this to be one of the easiest and most portable software to create images. easiest and most portable software to create images. Also, this image can be used in both FTK and Encase. Also, this image can be used in both FTK and Encase.
![Page 44: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/44.jpg)
Image Physical DriveImage Physical Drive
Always image the Physical drive.Always image the Physical drive.
![Page 45: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/45.jpg)
ImagingImaging
Remove hard drive from the Write Remove hard drive from the Write Block device. Block device.
Reassemble the computerReassemble the computer Ensure evidence remains tagged.Ensure evidence remains tagged.
![Page 46: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/46.jpg)
ImagingImaging
If court action is anticipated, preserve the If court action is anticipated, preserve the original evidence if possible.original evidence if possible.
If original evidence cannot be preserved, If original evidence cannot be preserved, NC Court Rules of evidence allow for the NC Court Rules of evidence allow for the image to be admitted as evidence. image to be admitted as evidence.
![Page 47: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/47.jpg)
ImagingImaging
FTK can take a few days to process FTK can take a few days to process your image.your image.
During this time, we return to our During this time, we return to our normal audit work normal audit work
![Page 48: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/48.jpg)
Examination/AnalysisExamination/Analysis
Run Keyword SearchesRun Keyword Searches Obtain from ClientObtain from Client
Review Corroborating Review Corroborating EvidenceEvidence EmailsEmails Surveillance VideoSurveillance Video DVD & CDsDVD & CDs
![Page 49: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/49.jpg)
Forensic ReportForensic Report
The auditor will issue a report to The auditor will issue a report to appropriate personnel once the appropriate personnel once the examination is completed.examination is completed.
![Page 50: Practical Application of Computer Forensics Lisa Outlaw, CISA, CISSP, CRMA.](https://reader036.fdocuments.net/reader036/viewer/2022062421/56649c875503460f9493ee92/html5/thumbnails/50.jpg)
Questions????Questions????