In the Introduction of this book, investigators were introduced to the four phases of computer forensics:
Now that investigators have covered basic skills and components of the first two phases, collection and preservation, it seems only fitting that filtering and presentation should be on the “what’s next” list. Once the critical stages of identifying, collecting, and preserving the evidence have taken place, it would seem that forensics investigators are free to analyze the evidence at their leisure. Indeed, the ability to recover from mistakes during the analysis phase is one of the benefits afforded by the bit-stream imaging process. Analysis can be a complex stage, ...