Incident response to digital evidence, acquisition and investigation processes

In this study, the necessity of incident response and image acquisition of Digital Evidence which is the first part of forensic investigation and which constitutes a significant part of cybercrime investigations, has been investigated. Errors made in the field where digital materials are located can shadow the authenticity and trustworthiness of the evidence, so errors made at this stage can cause the whole forensic process. Today, mobile phones, computer systems or internet are absolutely involved in crimes that committed. Digital evidence is the most important factor in the elucidation and disclosure of cybercrime. Since the examination of the originals of digital materials will destroy the integrity of the evidence, it is always necessary to take a forensic copy of the digital material that has been captured and examine it on this forensic copy. Digital Materials, the stage prior to the review phase of digital materials, is an important milestone in the initial intervention and image acquisition phase. The methods of image acquisition in Digital Evidence are divided into two classes as image acquisition from closed systems and image acquisition from open systems. In this study, it is informed about hardware and software used in taking image using in getting evidence in cybercrime investigation and the performances of the software that used are tested. Further more evidence finding time of the test software on an example scrip and ease of use are also analyzed.