List and describe the choices an organization has when setting policy about how to employ digital forensics.

Question

What will be an ideal response?

Answer 1

An organization must choose one of two approaches when employing digital forensics:
1. Protect and forget. This approach, also known as patch and proceed, focuses on the defense of data and the systems that house, use, and transmit it. An investigation that takes this approach focuses on the detection and analysis of events to determine how they happened and to prevent re-occurrence. Once the current event is over, who caused it or why is almost immaterial.2. Apprehend and prosecute. This approach, also known as pursue and prosecute, focuses on the identification and apprehension of responsible parties, with additional attention to the collection and preservation of potential EM that might support administrative or criminal prosecution. This approach requires much more attention to detail to prevent contamination of evidence that might hinder prosecution.