When should an examiner do a physical examination versus a logical examination, or both?
What will be an ideal response?
Answer:
Logical images are fairly fast for most devices, depending on how much memory the device has and how much of the memory is full. Physical images can take a very long time to make because on a large storage device, even if the storage is not full, the imager must look at the entire memory footprint, not just the part that has something saved to it. Based on what can be done for the particular device, the examiner should decide whether to obtain a physical or logical extraction or both. The logical extraction is fairly fast, and one may want to examine it for obvious evidence while the tool is making a physical image of the target.
You might also like to view...
Actions that can physically hurt or threaten to hurt people are known as:
a. Violent or personal complaints c. Violent or personal crimes b. Violent or personal discrepancies d. Violent or personal delinquencies
Determining whether a sentence of death should be handed down is usually placed in whose hands?
a. Prosecutor b. Judge c. Defense attorney d. Jury
Most of the alcohol consumed is absorbed from the stomach
a. True b. False
This Act called for the Attorney General to develop and implement guidelines for how officials should respond to victims and witnesses.
A. Child Victims’ Bill of Rights B. Victims of Crime Act C. Violent Crime Control and Law Enforcement Act D. Federal Victim Witness Protection Act