Detailed Forensic Procedure for Laptop computers

Forensic analysis is the process of accurately documenting and interpreting information for presentation to an authoritative group. In most situations that group would be a court of law, but management will often request forensic preservation of information as well. Due to the easily changeable nature of digital information, great care must be put into the handling of any forensic analysis. Evidence grade information must be unbiased, and complete before it can be relied upon. Not only must the data be collected, but also the original media must be preserved. Furthermore it is necessary to record the state of the computer that produced the data. Laptop computers present additional technical issues. The hardware in a laptop computer has typically been modified for energy preservation and size. These modifications can frustrate a forensic examiner's normal use of tools and procedures. This document will discuss what forensic analysis is and why it is important. Also discussed will be how laptop computers affect forensic analysis. Finally, this document will describe three procedures for developing forensic information from a laptop computer running a Microsoft operating system.