During your initial response, discuss four options when retrieving information from a live system.
Question
Related questions
Name four methods for hiding data on a hard drive, using the layers below the information classification layer only. How would you, as an examiner, detect these conditions?
How would you identify slack space (RAM and file slack)?
From the description of the file system layers, what would be the process for identifying unallocated space on a drive?
You have booted up your forensic workstation and a SCSI hard drive connected to the external chain is not detected. How would you resolve this?
Distinguish between an IDE and a SCSI hard drive
Leave an answer