Explain what this principle means for digital evidence.
Describe best practices
Explain what this principle means for digital evidence.
Describe best practices that should be followed to ensure digital forensic practitioners don’t leave their own “marks” on the evidence during collection and acquisition. You must use the provided course materials for at least one of the examples.
Choose three items of digital evidence from the following list and describe what types of digital “marks” (artifacts) might be left by a user. (Laptop, Router, External Hard Drive, Thumb Drive, Smartphone, Gaming Console, IoT devices, Home Surveillance Systems, Vehicles)
How can examiners/investigators use this information to prove or disprove the allegations under investigation?
What actions should a digital forensic professional take when encountering a running (live) laptop?
What beneficial data may be found on the live system that would not be found on a powered off (dead) system?
What is a hash value and what does it mean to hash data?
Describe two ways hash values are used by digital forensic practitioners.
Describe Chain of Custody and detail its importance in the Criminal Justice process.