Techniques - Revision history

Simsong: wow. Didn't raelize that RFC #### was special in mediawiki

2006-04-30T15:40:44Z

wow. Didn't raelize that RFC #### was special in mediawiki

Simsong at 15:39, 30 April 2006

2006-04-30T15:39:36Z

Uwe Hermann: Locard's exchange principle.

2006-03-30T19:00:13Z

Locard's exchange principle.

Uwe Hermann at 18:51, 30 March 2006

2006-03-30T18:51:23Z

Uwe Hermann at 00:12, 16 March 2006

2006-03-16T00:12:21Z

Jessek at 15:23, 29 October 2005

2005-10-29T15:23:25Z

New page

Although the methods for investigating computer forensics are limited only by an investigator's imagination, here are some guidelines on tried and true methodologies.

[[Data Reduction]] - By eliminating information that doesn't matter, an investigator is left with information that does matter.

← Older revision		Revision as of 15:40, 30 April 2006
Line 7:		Line 7:

	==Guidelines==		==Guidelines==
−	* ~~[http://www.faqs.org/rfcs/rfc3227.html~~ RFC 3227], "Guidelines for Evidence Collection and Archiving," D. Brezinski and T. Killalea, February 2002.	+	* RFC 3227, "Guidelines for Evidence Collection and Archiving," D. Brezinski and T. Killalea, February 2002.

← Older revision		Revision as of 15:39, 30 April 2006
Line 5:		Line 5:
	* [[Data Reduction]] - By eliminating information that doesn't matter, an investigator is left with information that does matter.		* [[Data Reduction]] - By eliminating information that doesn't matter, an investigator is left with information that does matter.
	* [[Locard's exchange principle]]		* [[Locard's exchange principle]]
		+
		+	==Guidelines==
		+	* [http://www.faqs.org/rfcs/rfc3227.html RFC 3227], "Guidelines for Evidence Collection and Archiving," D. Brezinski and T. Killalea, February 2002.

← Older revision		Revision as of 19:00, 30 March 2006
Line 4:		Line 4:

	* [[Data Reduction]] - By eliminating information that doesn't matter, an investigator is left with information that does matter.		* [[Data Reduction]] - By eliminating information that doesn't matter, an investigator is left with information that does matter.
		+	* [[Locard's exchange principle]]

@@ Line 1: / Line 1: @@
-Although the methods for investigating [[computer forensics]] are limited only by an [[investigator]]'s imagination, here are some guidelines on tried and true methodologies.
+Although the '''techniques''' for investigating [[computer forensics]] are limited only by an [[investigator]]'s imagination, here are some guidelines on tried and true methodologies.
 == Techniques ==
 * [[Data Reduction]] - By eliminating information that doesn't matter, an investigator is left with information that does matter.

← Older revision		Revision as of 00:12, 16 March 2006
Line 1:		Line 1:
−	Although the methods for investigating computer forensics are limited only by an investigator's imagination, here are some guidelines on tried and true methodologies.	+	Although the methods for investigating [[computer forensics]] are limited only by an [[investigator]]'s imagination, here are some guidelines on tried and true methodologies.

		+	== Techniques ==

−	[[Data Reduction]] - By eliminating information that doesn't matter, an investigator is left with information that does matter.	+	* [[Data Reduction]] - By eliminating information that doesn't matter, an investigator is left with information that does matter.