Chapter 7. Solutions in this chapter:
- Setting Up an Analysis Mac
- Imaging a Mac with a Mac
- Imaging a Mac with a Live CD
- Summary
- Solutions Fast Track
- Frequently Asked Questions
Introduction
Acquiring a forensic image of any piece of digital evidence is possibly the most important step in the forensic process. If the digital image is obtained poorly, it will be inadmissible in court. If you obtain the digital image of a logical partition when you should have gathered the physical device, you may lose a large amount of evidence forever. Worst of all, if you acquire the forensic image in a manner that taints the evidence you will skew the results or render them useless during the examination process. It is incumbent upon you as an examiner to understand ...
Get Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
