5ATTACHING SUBJECT MEDIA TO AN ACQUISITION HOST
This chapter discusses the physical attachment of subject storage media to an examination host, identification of the subject device on the system, and querying the device firmware for information. You’ll also learn about methods for removing HPA and DCO, unlocking ATA passwords, and decrypting self-encrypting drives. The chapter ends with several special storage topics. Let’s start by examining the subject PC hardware.
Examine Subject PC Hardware
When a PC or notebook is seized in the field or delivered to a forensic lab for examination, more than just the internal disks can be examined. Included ...
Get Practical Forensic Imaging now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
