Day 1 - Panel Discussion DFRWS 2004 Linthicum, MD

Day 1 - Panelists Mr. James Christy, SSA; Director, Defense Cyber Crime Institute, Defense Cyber Crime Center (DC 3 ) Mr. Chet Hosmer, Founder and President, Wetstone Technologies, Inc. Mr. Chris Sanft, CFE, Computer Training Specialist SEARCH Group, Inc.

Day 1 - Intro Each question will be posed to all three panelists. Some questions are multi-part Each panelist will have 5-6 minutes to respond Each round will be followed by a 10 minute Q&A session A transcript will be recorded

Day 1- Framework for DF Framework implies structure. Our hope is to define and apply some of this structure generically to digital forensic investigations. Question 1: –In your experience how much of an investigation, digital or otherwise, lies outside the bounds of ‘structure’? Briefly discuss the reliance on the talent of the examiner or analyst, dependence on success from other parts of the investigation (i.e. interviews, interrogations, footwork, other non-digital components) –Can the non-structured ‘art’ of investigation be accommodated in our framework? If so, how might that be accomplished? What features of the overall structure would be affected?

Day 1- Framework for DF It is safe to say that few if any investigations rely solely on digital evidence alone. Sources of evidentiary material usually cover multiple forensic disciplines Question 2: –How can a framework best consider the ‘integration’ of evidence from various sources? –Comment on the mix (or division) of skills required for practitioners who perform tasks at various stages of the process, so that collectively they can effectively ‘integrate’ their findings.

Day 1- Framework for DF The digital forensic community is growing almost exponentially. Our efforts here are only part of any potential solution path Question 3: –What are some recommended private, Federal, DoD, or international organizations that our group should be collaborating with to evolve an accepted digital forensic investigative framework? In your response, consider the investigative utility of having similar frameworks or processes between organizations that work together (e.g. DHS and DoD, DHS and FBI, etc.) Comment briefly on the process through which proposed frameworks would be vetted by the organizations you recommended.

Day 1 – Topics of Consideration Structure Content Dimensions Linear nature Methods Technology Integration (with other disciplines) Execution (flow) Categorization