How is Digital Forensic Investigation dfferent from Data Recovery Process ?

Normally data recovery process does not concern the details of chain of custody of data media, acquiring of un-tampered data source and, examination of data for evidence etc.

In general, the computer forensic proccess will involve techniques to identify, acquire, examine, produce and verify digital evidence or information.

• Identify the scope of work, target object data through understanding of investigation cases
• Acquire the subject system or data seizure without tampering or unauthorized changes during the investigation and duplicate a copy if necessary. Recover any lost or deleted files necessary for the investigation. A proper chain of custody of object evidence should be kept.
• Examine acquired data including all lost, hidden, encrypted or temporary files.
• Produce detailed report with data case exhibits and impartial assessment of the information collected
• Verify and ensue reproducibility of findings

It is essential that throughout the investigation, a full audit log of the investigation activities should be maintained and recorded. Such log may be called for as supporting documents subsequently.