Implementation of the methodology for forensic analysis of storage unit images

Abstract

The main objective of this article is to present a proposed methodology for conducting computer forensic investigations in a structured and effective manner. The methodology is divided into four main phases: identification, preservation, analysis and presentation of digital evidence. The identification phase focuses on securing the incident scene and organizing the objects found, including physical and logical evidence; during the preservation phase, it ensures that the digital evidence is maintained in its original state using techniques such as bit-by-bit copying and real-time data acquisition to effectively preserve the information; the analysis phase is carried out in a forensic laboratory and uses specific tools to investigate the digital evidence; and finally, the reporting phase is divided into a technical report and an executive report, which describe the methods used, the results obtained and the conclusions. To ensure the effectiveness and accuracy of the proposed methodology, it was evaluated by three Computer Security experts from the University of La Rioja through an expert judgment questionnaire and subsequently implemented in a hypothetical case. Among the conclusions, it highlights the importance of having a solid methodology in a world where digital information is crucial and offers valuable guidance to cybersecurity and IT professionals for the development and implementation of the methodology.