DFS101: 4.2 Digital Investigation Methods 

That is a great question! Digital investigation methods are individual procedures for doing some task. Techniques are which methods (and in what order) the investigator chooses to do some task. For example, there are many ways (methods) of recovering data from a hard drive. An individual investigator, however, will choose certain methods that they believe will work best for a particular problem. That choice is the technique, and everyone is slightly different even if the underlying methods are the same. You can think of it like dancing. Everyone can learn the same steps (method) of dancing, but great dancers add their own flair (technique) to the dance. Let me know if that's not clear!

@@DFIRScience Thank you but I need more clarification. Can these be the methods, Identify specific objects that store important data for the case, Investigation preparation, seizure isolation, acquisition of data, examination analysis and reporting..... And the techniques can be Preserving the evidence, web activity reconstruction, file signature verification, network device investigation and recovery hidden files.

@@upendodavid4991 Everything you've listed has aspects of both methods and techniques. Remember that a method is a procedure for achieving a goal. But many different methods can produce the same end goal. The technique is which method or combination of methods an investigator chooses to reach the goal. Let's look at one of your examples: "Identify specific objects that store important data for the case." This covers several ideas and needs to be broken down further. * Identify specific objects (data) - There are many methods (procedures) for identifying data structures. - An investigator may choose a combination of methods (technique) to maximize the amount of data identified. * that store case-related data - General methods and standards of court guide what is defined as "case-related" - An investigator's individual knowledge and choice of investigation structure can help support whether something is case-related. * important - Methods (rules) for argument and persuasion. - The investigator's individual writing style and investigation choices can affect whether something is perceived as important. An investigation is built on a large number of methods that an investigator chooses to maximize their outcome. All the things you listed have aspects of both methods and techniques. NOTE: Most people will not differentiate between methods and techniques. All the things you've listed can be colloquially described as "methods". For practical purposes, you can use the terms interchangeably, and people won't mind.

@@DFIRScience Thank you for the explanation, you have been a great help.

Great to hear! I hope it's helpful. let me know if you have any questions.

I'm glad it was helpful. Please share with your class and let me know if you/they need anything else.

I would start by looking at some of the documents here: www.swgde.org/documents/published They are specific to the USA but it is a good place to begin.

I'm glad you like it

You're looking for materials specific to digital investigation methods?

@@DFIRScience Materials on The Digital Forensics Investigation, sir. For mostly that I have seen online were quite complicated. Tbh, we've been watching your videos regarding forensic Investigation for it was really a great help. However, due to the lack of connectivity here in our place, our students were having a hard time watching it😅

If you are the victim of a crime, please report to your local Police.

Xbox is easier than PlayStation. :D

@@DFIRScience oh. I never played one. Sorry.

@@demontrionjackson1639 You're still welcome to send me an Xbox. ;)