Computer Forensics InfoSec Pro Guide

CHAPTER 8

Capturing Evidence

We’ll Cover

 

   Creating a forensic image of a hard drive

   Creating a forensic image of an external storage drive

   Creating a forensic image of a network share

 

This chapter discusses how to capture evidence, in the form of a forensic image, from various sources. We will also discuss what you can and cannot recover from each source. Because you should always try to create a forensic image with a forensically sound ...