Chapter 16
Applying Forensic Science to Computers
Eoghan Casey
Contents
Like a detective, the archaeologist searches for clues in order to discover and reconstruct something that happened. Like the detective, the archaeologist finds no clues too small or insignificant. And like the detective, the archaeologist must usually work with fragmentary and often confusing information. Finally, the detective and the archaeologist have as their goal the completion of a report, based on a study of their clues, that not only tells what happened but proves it.
Digital evidence examination is analogous to diamond cutting. By removing the unnecessary ...
Get Digital Evidence and Computer Crime, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
