Extract from Doug Austin’s article “Standardizing the Non-Standard Digital Forensics Protocol, Sort Of: eDiscovery Best Practices”
Leave it to Craig Ball to come up with a proposed form examination protocol for performing forensic examinations. And, leave it to Craig to teach you what you need to know to use and adapt such a protocol.
In his latest blog post on his Ball in Your Court blog (Drafting Digital Forensic Examination Protocols, available here on his blog and here on his site in PDF form), Craig discusses the ins and outs of putting together a forensic examination protocol, equating the drafting of such a protocol to “writing out the questions in advance” when taking the deposition of a computer or smart phone. In an unusually long blog post for Craig’s blog (dare I say a “Losey-ian” length blog post?), Craig thoroughly covers the considerations regarding drafting a sensible forensic examination protocol (which, as Craig notes, “demands a working knowledge of the tools and techniques of forensic analysis so counsel doesn’t try to misapply e-discovery methodologies to forensic tasks”).
