An investigator would like to take a forensic "image" of a suspect's hard disk drive. What is the primary goal in obtaining data from a HDD? What tools can the investigator use to achieve this goal?
What will be an ideal response?
Answer should include points such as the following:
The primary goal in obtaining data from a HDD is to do so without altering even one bit of data.
A Message Digest 5 (MD5)/Secure Hash Algorithm (SHA) takes a "fingerprint" of a hard disk drive (HDD) before and after forensic imaging. A forensic computer examiner would run such an algorithm to demonstrate that the forensic image recovered is all-inclusive of the original contents and that nothing was altered in the process.
You might also like to view...
_________ is used when discussing three or more things or persons
Fill in the blank(s) with correct word
__________ is the strategic deployment of existing police resources based on an analysis of crime statistics
a. Directed patrol b. Community policing c. Marginal deterrence d. Displacement
Trace evidence is a type of circumstantial evidence, examples of which include:
a. hair found on a brush. b. fingerprints found on a glass. c. blood drops on a shirt. d. All of these choices.
_____ is the philosophy of allowing the state to serve as the guardian of juveniles who might not be able to fend for themselves
Fill in the blank(s) with correct word