Forensics should answer specific questions
An investigation without a question becomes an open-ended examination of everything.
What was taken, when did they get in, is it still happening, are other systems affected. Each of those directs you to different evidence and each has a point at which it is answered. Analysis that is not anchored to a question expands to fill whatever time exists and often does not settle the thing the business needed to know.
More on Digital forensics
- Forensic copies protect original evidenceMark the copy, never the original
- Hashes can show evidence stayed unchangedThe same short string, twice
- Timestamps need interpretationOne moment, three different times
- Memory can reveal what disk cannotIt has to unwrap itself to run
- Forensic tooling can change the thing examinedYou leave prints of your own
- Deleted does not always mean goneThe card, not the book