O'Reilly logo

Computer Forensics JumpStart, Second Edition by Diane Barrett, Neil Broom, Ed Tittel, K Rudolph, Michael G. Solomon

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Disk Imaging and Validation Tools

After identifying the physical media that they suspect contains evidence, forensic investigators must make sure media is preserved before any further steps are taken. Preserving the media is necessary to provide assurance the evidence acquired is valid.

Chapter 3, “Computer Evidence,” and Chapter 4, “Common Tasks,” both emphasize the importance of copying all media first and then analyzing the copy. It’s usually best to create an exact image of the media and verify that it matches the original before continuing the investigation. It’s rare to examine the original evidence for any investigation that might end up in court. For other types of investigations, however, forensic investigators might perform a targeted ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required