1. The scene
You secure the devices against the clock. You decide what to power down, what not to touch and what to record in the protocol. A mistake here comes back to you two levels later.
One case, three stages, every decision has consequences
BursztynSoft's customer database has leaked. You run the case from the scene, through the laboratory, all the way to the courtroom — and you find out that the value of the evidence is decided by what is done in the first few hours, not in the report.
Play — free, nothing to install
How it unfoldsYou secure the devices against the clock. You decide what to power down, what not to touch and what to record in the protocol. A mistake here comes back to you two levels later.
You carry out the acquisition: you choose the extraction method and watch the write blocker and the checksums. What comes out of here is the only material anyone can work on later.
You analyse the material, write the expert report and answer questions under examination. The defence will pick at every gap in the documentation from the earlier stages.
Chain of custody and documenting each step. The checksum as a seal on the material. The difference between an original copy of the data and a report produced from analysing it. BFU and AFU states in a phone. The write blocker during disk imaging. The requirements of ISO/IEC 27037 and what a court expects from an expert report.
Before you startRead moreDisclaimer. The game simplifies procedures and regulations. It is not legal advice and it is not an interpretation of the standard. It is there to help you understand the mechanisms; it does not replace the knowledge of a forensic expert or a lawyer.