Explore BrainMass
Share

Explore BrainMass

    bit-by-bit image of the hard drive for forensic purposes.

    This content was COPIED from BrainMass.com - View the original, and get the already-completed solution here!

    When collecting evidence, it should be as close to its natural state, untouched and untampered with. Therefore, when a computer hard drive is to be collected for digital evidence, it is important that it should be prevented from the computers' operating system or other software processing/changing any data on the drive. This would enable to capture the hard drive in its original state of with no interference from other software or hardware, and even the users.

    © BrainMass Inc. brainmass.com October 10, 2019, 8:20 am ad1c9bdddf
    https://brainmass.com/computer-science/artificial-intelligence/bit-bit-image-hard-drive-forensic-purposes-620009

    Solution Preview

    Please see attached Word document for Solution.

    Why it is important to have a bit-by-bit image of the hard drive for forensic purposes?

    When collecting evidence, it should be as close to its natural state, untouched and untampered with. Therefore, when a computer hard drive is to be collected for digital evidence, it is important that it should be prevented from the computers' operating system or other software processing/changing any data on the drive. This would enable to capture the hard drive in its original state of with no interference from other software or hardware, and even the users.

    The few reasons why a bit-by-bit image of the hard drive is important are listed as such:

    1 This is the method of capturing the actual representation of data on the hard drive where no manipulation of software is involved.

    2 This is the most detailed layer a data can be stored from which evidence can be recovered with a detailed analysis.

    3 Sometimes, files are overwritten over bigger files, and the remaining portion is still available, ...

    Solution Summary

    When collecting evidence, it should be as close to its natural state, untouched and untampered with. Therefore, when a computer hard drive is to be collected for digital evidence, it is important that it should be prevented from the computers' operating system or other software processing/changing any data on the drive. This would enable to capture the hard drive in its original state of with no interference from other software or hardware, and even the users.

    $2.19