3
Acquisition of Evidence
Digital evidence is one of the most volatile pieces of evidence an investigator can handle, and the slightest error or mishandling on the investigator’s part can severely affect the investigation. For example, you may lose the data forever or lose pieces of it. In addition, the unintentional manipulation of data can cast doubt on your ability to investigate or question the integrity of the data in the investigation. This chapter will address minimizing or eliminating any of these issues by using a tool validation process to create an error-free and validated forensic image.
We will cover the following topics in this chapter:
- Exploring evidence
- Understanding the forensic examination environment
- Tool validation
- Creating ...
Get Learn Computer Forensics - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
