Crosby-Signed Thesis - Alliance Digital Repository

IMPACT OF IPV6 TRANSITION MECHANISMS ON THE NETWORK FORENSIC
9
7. Search for evidence.
8. Collect the evidence.
9. Preserve, transport, copy, and store the evidence for analysis.
10. Examine and verify the integrity and validity of the evidence in relation to the
identified events and internal data relationships.
11. Classify and separate the evidence into individual components.
12. Prioritize the evidence by identifying the most compelling components.
13. Reconstruct the events and link the physical data to the milestones in the event
history.
14. Consult experts and other specialists when necessary.
15. Analyze and document the conclusions.
16. Verify the availability of resources to advance the investigation or case.
17. Verify if the schedule and event history is feasible given the facts of the case.
18. Decide whether to move forward, look for more evidence, or drop the case.
19. Profile and summon suspects.
20. Present the evidence and case to the prosecutor and court.
21. Prove the case and challenge any presented defenses.
22. Return the evidence to the owner and restore affected systems to their previous states.
23. Disseminate the knowledge and improve criminal profiles to aid in future cases.
Table 1 illustrates which of the ten frameworks presented in the document explicitly contain
elements of the twenty-three common processes.