This was a talk presented by Eric B. at our 1/8/2017 meeting. The topic was Conducting Defensible Investigations.

The slide deck is available here: Conducting Defensible Investigations

Key terms:

Defensible in this context is something that can withstand being challenged in court

Forensics of or having to do with the court system

Incident Response operationalization of a risk management process to address known or unknown hazards

Investigations & Inquiries – investigation is an act taken by an investigative authority (legal term) while an inquiry is an investigation undertaken without investigative authorities (no subpoena powers, no search & seizure or arrest powers)

There is a big difference between proper “Incident Response compared to an IT ticket. One of them requires documentation, retention of data & mitigation, whereas the other, only cares about the solution to the problem & resolving it. This difference can be further widened by standard incident response & defensible incident response which includes *high levels of documentation*.

A big portion of this is Incident Response Planning (need some good links here)

There are some vendor specific certifications: EnCase, FTK, Autopsy, Cellbrite, Tableau

Although the topic of this talk was more about investigation as a process, DFIR places a huge role in that. The links below are heavily based in the DFIR camp, as we would like to get the information out there & see talks potentially building on this topic to include DFIR.