Chapter 4
1. What is the first common task when handling evidence?
Answer: In any investigation, your initial task is to identify the evidence you need for your case. In fact, you’ll want to begin your efforts by making a complete photographic survey of the surroundings to document where and when you identified items worthy of investigation.
2. Which type of hardware is seldom of interest to an investigation?
Answer: Any hardware that does not include built-in storage of some kind – including such things as keyboards, mice, and monitors – cannot provide evidence in an investigation. Thus, it will seldom be of interest to an investigation, either, beyond its role in establishing that a particular person used a computer (such as fingerprints ...
Get Computer Forensics JumpStart, Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
