ABSTRACT
Forensics is the application of the scientific process to answer a question. For digital forensics to be an accepted science, it has to apply the scientific method. The scientific method is the application of a set of accepted and verifiable steps to investigate a question or problem. The digital forensic process needs to include a thorough enough review to confirm findings, and it should not overlook artifacts that may discredit the findings. A corporate investigation may center on the presence or absence of a particular file or set of files, software, or correspondence. Interviews should be at the top of the list when responding to a situation and beginning an investigation. The interview may be with coworkers who have knowledge of the case, suspects, or victims. In many cases lawyers are involved and that adds another dynamic to the discovery process. Mobile devices often require that they be live in order to perform a forensic exam.
