Forensic best practices play a big part in what we do and, traditionally, refer to handling or acquiring evidence. However, we've designated some forensic best practices of our own when it comes to programming, as follows:
- Do not modify the original data you're working with
- Work on copies of the original data
- Comment code
- Validate your program's results (and other application results)
- Maintain extensive logging
- Return output in an easy-to-analyze format (your users will thank you)
The golden rule of forensics is: strongly avoid modification of the original data. Work on a verified forensic copy whenever possible. However, this may not be an option for other disciplines, such as for incident responders where the parameters and scope varies. As always, this varies on the case and circumstances, but please keep in mind the ramifications...
