![]() ![]() Using an imaging device, the speed of image creation, as well as verifying hash values, is typically faster when compared to the multiple steps in creating the image using a third-party software. This might be a good alternative to using a write blocker, especially if you are not an expert at the process of creating an image. An imaging device differs from a write-blocker in that it creates a forensic image for you. An imaging device contains read-only access without the risk of damaging the drive’s contents. Using a stand-alone imaging device greatly decreases the chances of altering data. Connecting a drive to a computer without a write blocker will usually change the data, resulting in unintentional alterations to the data. To make sure the data is not altered, investigators can use a write blocker. If the data for investigation reaches court, the information presented in a computer crime case must be legitimate. ![]() If you are given a hard drive to investigate, it probably would not be in your best interest to directly connect the device to the workstation. ![]() You are immediately excited for your first solo assignment, until you look down at the hard drive and think: “Now what do I do?” Do you plug it in to your computer and start to investigate? Do you use one of the tools that you find in the lab to interrogate the hard drive? Let’s discuss the options available that may come in handy if you ever find yourself stuck in this position. Imagine you’ve just been handed a hard drive from your boss who gives instructions to find all the vital information on it. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
January 2023
Categories |