O'Reilly logo

Computer Evidence: Collection and Preservation, Second Edition by Christopher L. T. Brown

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Summary

  • Evidence may be limited either to a small number of documents on a removable disk found at the scene or a single fragment of data on a removable flash drive.

  • Understanding how to identify and process removable media can be critical to an investigation.

  • Using removable media is often the method employees use to transport intellectual property out of enterprises.

  • The archiving habits of users can often be beneficial to forensics investigations

  • Because it is not always cost effective to convert legacy archival data to new systems, investigators will often find archive tapes in two or more physical formats and possibly several different logical tape file formats within organizations.

  • Generally speaking, gold CD discs provide the highest quality, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required