April 2020
Beginner
368 pages
8h 12m
English
Content preview from Learn Computer Forensics
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Chapter 3: Acquisition of Evidence
Digital evidence is one of the most volatile pieces of evidence an investigator can handle, and the smallest error or mishandling on the investigator's part can severely impact the investigation. You may lose the data forever, or you might lose pieces of it. Unintentional manipulation of data can call your ability to investigate into question, as well as the integrity of the data in the investigation. This chapter will address how to minimize or eliminate any of these issues by using a tool validation process to create an error-free and validated forensic image.
We will cover the following topics in this chapter:
- Exploring evidence
- Understanding the forensic examination environment
- Tool validation
- Creating ...