Learn Computer Forensics - Second Edition

4

Computer Systems

As we discussed in previous chapters, digital forensic investigators must control the environment they operate in. The diversity of computer hardware, operating systems, and filesystems requires the digital forensic investigator to have a firm understanding of all the different and potential configurations they may encounter. This requires the digital forensic investigator to have procedures or controls to protect the integrity of digital evidence and the processes used to examine it. If you do not understand the boot process and how the system reacts when it starts or which filesystem is used on storage devices, you could make a fatal mistake. In addition, you must understand how they work together. Failure to understand ...