|
The first reaction of most people, even most computer professionals, is to back up critical hard drive files. This is exactly the right answer - except when evidence may end up in court.
A Windows backup does not include information on the hard drive from deleted files or critical areas such as disk slack, the portions of disk sectors which are leftovers from old files.
Slack areas and unused portions of the disk are where we find the most critical information in our investigations.
Drive images are produced by using software and hardware which is intended, designed, tested and certified to not alter the information on the original hard drive.
A faithful copy is made of all bytes on the disk.
If a well-intentioned person offers to back up your evidence file just say NO! Get an exact image made by a real forensics professional.
|
| | |  | | 
In court cases the first question that we hear from sharp attorneys on the other side has to do with the integrity of evidence.
If investigation was not done on an exact copy it is suspect.
If an original disk which held evidence is altered the whole case may be affected.
Using forensic software and a firm that is experienced in the field is critical to investigations - and success in court.
| | | | |
