EC-Council: Computer Hacking Forensic Investigator(CHFI-V10) |
||||
Module 2 : Computer Forensics Investigation Process |
||||
| Notes available : 7 |
You are not logged in. Please Login for track your learning progress |
|||
Bookmark this Note
Note ID: 151
Evidence Reconstruction
If you want to share the link of this note, please click here to "Copy note link" and share that generated link. Link from URL may change in future.
Once the evidence related to the case is analyzed, investigators can use it to reconstruct the crime and identify the missing links. There are three ways, in which investigators can reconstruct a crime:
▪ Temporal analysis: It produces a sequential event trail, which sheds light on important factors such as what happened and who was involved.
▪ Relational analysis: It correlates the actions of suspect and victim.
▪ Functional analysis: It provides a description of the possible conditions of a crime. It testifies to the events responsible for a crime in relation to their functionalities.
 |
Go to notes |  |