Triage

Two major challenges in modern-day forensics are urgency and volume of data. Needless to say, modern computers can carry large amounts of data, and sorting through all that data is a very difficult task. Most examinationsExamination are also urgent in the sense that you are expected to deliver results quickly. Consider a case where a multimillion company is at a stand-still because of an incidentIncident that needs to be resolved by the forensic team before normal operations can resume! To manage accurate and timely examinationsExamination, triageTriage comes into play. As outlined in this chapter, triageTriage is essentially the practice of prioritizing tasks so that the most important tasks are done first. This chapter outlines how triageTriage is used in forensic examinationExamination and describes some commonly used triaging techniques.