Computer Forensics and Digital Investigation with EnCase Forensic v7

CHAPTER

13

Wrapping Up the Case

In Chapter 1, we discussed the phases of an investigation, which ended with the case closure phase. In this phase, evidence is disposed of according to the lifecycle process identified by the organization for their evidence. Likewise, the original equipment is also disposed of according to established retention policy. In this chapter, we will discuss some of the considerations for how to manage the lifecycle of evidence and specifically, the types of things that should be done as part of case closure and final disposition.

If you haven’t already defined all processes around the evidence lifecycle—from collection ...