Section 5:

Digital Evidence Controls, Computer Forensic Analysis, and Recovering Files

Digital evidence is digital information that may be used as evidence in a security investigation case. Computer forensic analysis involves searching, preserving, and reviewing information on a computer to find potential legal evidence. File recovery involves retrieving a damaged or deleted computer file.

As system administrator, you need to further develop your Network Architecture Security Plan Proposal for your organization with information regarding digital evidence controls, computer forensics, and file recovery.

In this section, perform the following:

Describe how you will preserve information for forensic analysis.

Identify digital evidence controls that are in place for your network.

Research, analyze, and recommend at least 2 computer forensic tools for forensic analysis and file recovery to be used on your network.

Describe each of the tools, and explain how each tool will help support forensic analysis and file recovery