Digital Forensics Processing and Procedures

Note

It is assumed that only two copies of the image are taken and usually this requires two tools. If only one tool is used, then just this section should be filled in.

Image Method

The imaging method will come from the drop-down where the imaging methods have been entered in the maintenance system process.

Operating System

The operating system for the acquisition box will come from the drop-down where the imaging methods have been entered in the maintenance system process.

Blocker Used

Enter the details of the write blocker used.

Acquisition Hash

The acquisition hash for the exhibit.

Verify Hash

The verification hash for the exhibit.

Image 2

This is where the details of the second image of the evidence is recorded if second ...