December 2008
Intermediate to advanced
576 pages
13h 57m
English
Acquiring a forensic image of any piece of digital evidence is possibly the most important step in the forensic process. If the digital image is obtained poorly, it will be inadmissible in court. If you obtain the digital image of a logical partition when you should have gathered the physical device, you may lose a large amount of evidence forever. Worst of all, if you acquire the forensic image in a manner that taints the evidence you will skew the results or render them useless during the examination process. It is incumbent upon you as an examiner to understand ...
Read now
Unlock full access