COMPUTER FORENSICS
HOW DATA IS STORED
Generally speaking, an HDD needs to have its space defined before it is ready for use. Partitioning the HDD is the first step. When partitioned, HDDs are mapped (formatted) and have a defined layout.
RAM
Referred to as volatile memory because it is not permanent; its contents undergo constant change and are forever lost once power is taken away from the computer.
Motherboard
The main circuit board contained within a computer. The computer, aware that it may need certain data at a moments notice, stores the data in RAM.
FORENSIC IMAGE ACQUISITION 2
Because booting an HDD to its operating system changes many files and could potentially destroy evidentiary data, obtaining data is generally accomplished by removing the HDD from the system and placing it in a laboratory forensic computer so that a forensic image can be created.
Hardware
Comprises the physical components of the computer.
Software
Conversely, is a set of instructions compiled into a program that performs particular tasks on the hardware.
LATENT DATA
Data of which the operating system is unaware. The constant shuffling of data through deletion, defragmentation, swapping, and so on is one of the ways that data is orphaned in latent areas. Finally, when a user deletes files, the data typically remains behind.
Hard Disk Drive 2 (HDD)
Examiners must be familiar with the file system that they are examining. Evidence exists in many locations and in numerous forms on an HDD. The type of evidence can be grouped under two major sub-headings: visible and latent data.
THE BASICS
Hardware vs. software
IP ADDRESSES
IP addresses provide the means by which data can be routed to the appropriate location, and they also provide the means by which most Internet investigations are conducted. IP addresses take the form ###.###.###.###, in which, generally speaking, ### can be any number between 0 and 255.
TEMPORARY FILES AND SWAP SPACE
Temporary files, created by programs as a sort of "back-up on the fly," can also prove valuable as evidence. Finally, data in the swap space (utilized to conserve valuable RAM within the computer system) can yield evidentiary data.
VISIBLE DATA
The data of which the operating system is aware. Consequently, this data is easily accessible to the user.
INTRODUCTION
The use of computers and other electronic data storage devices leaves the footprints and data trails of their users. Computer forensics involves the preservation, acquisition, extraction, and interpretation of computer data.
FORENSIC IMAGE ACQUISITION
Throughout the entire process, the computer forensic examiner must adopt the method that is least intrusive. The goal of obtaining data from an HDD is to do so without altering even one bit of data.
Hard Disk Drive (HDD)
Typically the primary location of data storage within the computer. Different operating systems map out (partition) HDDs in different manners.