Analyzing forensic image file contents
In the previous chapter, we’ve covered how to capture/create a forensic image of both RAM and hard drive memories. Now, we are ready to move on to the next part of forensic work, which is analyzing acquired images for interesting leads.
All analysis work should be conducted on the forensics image only; forensic examiners should not interfere with the original suspect device to avoid damaging original evidence accidentally and thus making the entire investigation useless in a court of law.
Analyzing Hard Drive Forensic Images
The ...
