The preparation phase of digital search is the most important phase of the digital investigation process. If not carried out correctly, the can lead to improper handling of evidence that may lead to damage of crucial materials to an investigation. This phase involves the preparation of tools, techniques, search warrants, and monitoring authorizations and management support. Venansius & Tushabe (2004). It is therefore important that adequate resources are allocated to the preparation phase. Beebe & Clark (2007) elaborate more on this phase as the process of preparing tools and equipment, honing forensics skills, and continuing to become educated about on new technologies and tools that may be useful in dealing with the incident.
Due to the volatility of digital materials, the preparation phase should not only account for identifying and implementing the correct tools and resources, but also placing the right qualified individuals. Carrier (2002) describes digital forensics tools as programs or critical applications that are dedicated to obtaining information for use as evidence or evidence necessary for certain legal action. These tools are often complicated and if not used by qualified individuals could cause harm or irreparable damage to the digital materials sought to identify and use for legal purposes. Preparation needs to be at the forefront of any digital forensics investigation and the right people and tools must be at the center of this phase.
Beebe, N. L., & Clark, J. G. (2007). Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results. Digital investigation, 4, 49-54.
Carrier, B. (2002). Open source digital forensics tools: The legal argument (pp. 1-11). stake.
Venansius, B., & Tushabe, F. (2004). The Enhanced Digital Investigation Process Model. Institute of Computer Science, Makerere University. Retrieved from: http://www.forensicfocus.com/enhanced-digital-investigation-model