Know Your Hardware
Information can be retrieved from many hardware devices, including internal and external hard drives, CD-ROMs, USB flash drives, Compact Flash devices, memory cards or sticks, and smartphones. Information stored on such devices is nonvolatile, and usually persists intact when such a device is powered off (and sometimes even after erasure).
By comparison, devices such as keyboards, monitors, and printers do not store data permanently (or at all). These devices are used to send data to and receive data from computers. After a computer is turned off, these devices do not truly store information. However, a trained computer forensic investigator who employs specialized techniques can often find data or evidence on these devices ...
Get Computer Forensics JumpStart, Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
