Chapter 7. Acquiring Data, Duplicating Data, and Recovering Deleted Files
Topics we'll investigate in this chapter:
▪ Recovering Deleted Files and Deleted Partitions
▪ Data Acquisition and Duplication
Summary
Frequently Asked Questions
Introduction
Before you can analyze data, you need to acquire it. This means the data needs to be duplicated so that the person performing the analysis can work from it without modifying the data. As we saw in Chapter 6, this can require using any number of tools to duplicate the data so that an exact, sector-by-sector mirror image of the disk is generated. This enables the forensic analyst to view any data that is hidden, fragmented, or deleted. Whether data is being duplicated as part of a computer forensic investigation, ...
Get Scene of the Cybercrime, 2nd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
