This is my fourth entry here in my INVESTI blog! Yehey!! 🙂 This week was our SOCIT week and that’s the 7th week. Before Sir Investi sends us down for a seminar, he briefly explained what is a First Responder and what are the procedures if you are that person. I saw the slides and saw the very definition of a first responder. It means that it is the first person who arrives at the scene of the crime. Base from the context of the first responder, I immediately thought of the meaning of the first responder and I was right! 🙂 The first responder has roles and jobs to fulfill and those jobs are: protecting the evidence, integrating the evidence, and preserving the evidence at the scene of the crime. The responder may be network administrator, law enforcement officer and etc. I already imagined that I am the first responder at the scene of the crime. Base from the lesson, I already know the sequence of what to do if there is any evidence present. There are also procedures on what to do if you are the first responder. I had read the roles and I already understood why this is important and why should it be followed.
I thought that if these procedures are followed, then there is no compromise of the evidence being handled. If these procedures are not followed, then the evidence wouldn’t be useful to the investigation since it wasn’t handled properly. Next was the rule of a first responder. It was that if the first responder has no experience in computer forensics, that person should avoid any attempts in recovering any files or using the computer. That should be avoided because if an untrained person tries to use the computer, it maybe a trigger for a self destruct virus or the integrity of the computer will change. There is compromise of the evidence that is related to the case and that should be preserved and should not be touched unless a qualified computer forensic personnel is present. I learned many things this week and I am interested in what else in is stored for the INVESTI subject.