296 ◾ Information Security Management Handbook
because someone who obtained unauthorized access to the supposedly secure facility could alter
the data, say, on a flash memory drive. Moreover, processing and analyzing the data may be diffi-
cult, as they have to be done piecemeal. So, a catch, copy, and release strategy is more appropriate.
Catch means to acquire the piece of media, copy means to faithfully duplicate the data and secure
them for chain-of-custody purposes, and release means to return the original piece of media for its
originally intended purpose.
For backup tapes, native-environment restoration requires the original backup/restore soft-
ware to be used in copying (which is the purpose of this particular restoration) the data to ...