First, as mentioned earlier, previews of the evidence can be performed on the imaged copy with less worry about the investigator inadvertently damaging information on the original hard drive. However, there are a number of good reasons to perform imaging on-scene for most computer crimes. Rarely do you hear of a drive being both imaged and previewed on-scene, although such a process may actually address a number of concerns about the use of preview software to review the information on a drive while on-scene-specifically, performing a preview of the evidence on the original drive.Īlthough the acquisition of an image of a drive on-scene may be fairly common among the more technically skilled, usually for corporate crimes, we find there is little use of this technique by less-skilled personnel for low-level crimes. In both of these cases, the analysis of the imaged drive usually occurs back at the laboratory. Imaging an entire hard drive on-scene is fairly common among the more technically savvy digital crime scene responders-even more so for private sector investigators who often face cases where the hard drives need to be examined, but the business in question is not comfortable with letting the original drive out of its possession. Dale Liu, in Cisco Router and Switch Forensics, 2009 Imaging Information On-Scene
0 Comments
Leave a Reply. |