The learning objectives for day 24 were:
- Static acquisition: A bit-by-bit image of the disk is created while the device is turned off.
- Live acquisition: A bit-by-bit image of the disk is created while the device is turned on.
- Logical acquisition: A select list of files is copied from the seized device.
- Sparse acquisition: Select fragments of unallocated data are copied. The unallocated areas of the disk might contain deleted data; however, this approach is limited compared to static and live acquisition because it doesn’t cover the whole disk.
In this task we learned about acquiring digital forensics evidence to present in court, how to acquire a smartphone image and to use the Autopsy tool.
We had to use autopsy to analyse the smartphone image and find data, confirming his involvement in the crime.
Click here to see the tutorial.
No comments:
Post a Comment