O'Reilly logo

Digital Forensics and Incident Response by Gerard Johansen

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Preparing a stage drive

Beyond having the necessary hardware and software to perform the forensic imaging, it is critical to pre-stage a location to hold the image or evidence file. For incident response teams, the best option to utilize as an evidence repository is an external USB or FireWire disk drive. This allows for a degree of portability, as incident responders may have to investigate an incident offsite or at a variety of locations without the benefit of a forensics laboratory.

There are two tasks that need to be performed on evidence drives prior to their use. The first is to ensure that the repository is free of any data. Incident response teams should have a policy and procedure that dictates that an evidence drive be wiped prior ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required