Write blockers could be hardware or software.To guarantee that no change has would occur to the original digital media, using write blockers is recommended.Various dd-based utilities such as dcfldd, which is also capable of generating hash at the end of process.A program called dd, which was originally a Unix utility.When imaging is done, a process called hashing generates a hash to ensure that the image and original media are the same.The image is just a file which can be handled easily.Creating an exact copy of the original digital media that investigators can examine is commonly referred to as making a bitstream image or simply the imaging process.Therefore, the first step is to create an exact duplicate of the media to be examined.Working directly on the original evidence (e.g., hard disk of a computer) in any forensic data recovery operation or computer forensic investigation is not allowed as the investigation can make irrecoverable changes to the source data.Free Digital Forensic Investigation Tools and Live CDs For Digital Forensics.Imaging in Digital Forensics- Dead Imaging vs.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |