From the course: Cloud Security Operations by Pearson

Unlock this course with a free trial

Join today to access over 25,200 courses taught by industry experts.

Ediscovery and forensics

Ediscovery and forensics

From the course: Cloud Security Operations by Pearson

Start my 1-month free trial Buy for my team

Ediscovery and forensics

“

Let's look at the e-discovery process. In phase one, we have identification. Electronically stored information, otherwise known as ESI, that is feasibly important to a case is recognized, along with locations, custodians, sizes, volumes, and more. Then we have preservation. The identified, potentially relevant ESI, or electronically stored information, is placed under legal hold many times, starting the official forensic process. You have to ensure beyond a doubt that the information is secure. Third is collection. The ESI is pulled together from the original custodian or controller, frequently by physically moving the original digital storage media to a safe chain of custody, and of course using write-blocking technology, for example, FTK Imager. Phase 4 is Processing. Forensic bit copies are stored for search or analysis for information relevant to the case, using appropriate forensic techniques and toolkits, for example, NCASE by Guidance Software. Then we have the review phase…

Contents