Digital Forensics Basics: A Practical Guide Using Windows OS

© Nihad A. Hassan 2019

Nihad A. HassanDigital Forensics Basicshttps://doi.org/10.1007/978-1-4842-3838-7_6

6. Analyzing Digital Evidence

Nihad A. Hassan¹ 

(1)

New York, New York, USA

 

Analyzing forensic image file contents

In the previous chapter, we’ve covered how to capture/create a forensic image of both RAM and hard drive memories. Now, we are ready to move on to the next part of forensic work, which is analyzing acquired images for interesting leads.

All analysis work should be conducted on the forensics image only; forensic examiners should not interfere with the original suspect device to avoid damaging original evidence accidentally and thus making the entire investigation useless in a court of law.

Analyzing Hard Drive Forensic Images

The ...