Triage

Abstract

Two major challenges in modern-day forensics are urgency and data amounts. Needless to say, modern computers can carry large amounts of data, and sorting through all that data is a very difficult task. Most examinations are also urgent in the sense that you are expected to deliver results quickly. Consider a case where a multimillion company is at a stand-still because of an incident that needs to be resolved by the forensic team before normal operations can resume! To manage with accurate and timely examinations, triage comes into play. As outlined in this chapter, triage is essentially the practice of prioritizing tasks so that the most important tasks are done first. This chapter outlines how triage is used in forensic examination and describes some commonly used triaging techniques.