The traditional approach to a digital investigation when a computer system is encountered in a running state is to remove the power, image the machine using a write blocker and then analyse the acquired image. This has the advantage of preserving the contents of the computer’s h…
"13" Result
Sort By:
"In this book the authors show how information held in computer systems can be recovered when it has been hidden or subverted by criminals, and give the reader the means to insure that it is accepted as admissible evidence in court. It is illustrated with plenty of case studies …
Forensic computing: a practitioner's guide
by Jenkinson, Brian, Sammes, Tony, Sammes, A.J
0
Type: Book