Digital Foreinsics Week 3 Discussion: Collecting, Seizing, and Protecting Evidence

Digital Forensic is a part of forensic that focuses on investigating and recovering digital evidence found on digital devices. This type of investigation requires analyzing information, devices, and machines. Such analysis is important to figure out and collect evidence. The type of analysis which deals with hard drive structures and file formats are physical analysis and logical analysis. Physical analysis is an analysis conducted on evidence that has already been retrieved on a disk or as a forensic duplicate. It is conducted to recheck things that might have been overlooked or was invisible. Similarly, logical analysis is also an analysis, conducted on evidence that has already been retrieved on a disk or as a forensic duplicate, however, the logical analysis looks for things that are known about or visible and it is done using the native operating system to pursue the data. 

The processing steps for physical analysis are at first checking for a list of URLs and email address on computers. If any of the lists are deleted it can be retrieved using software and tools Like Encase. The other step is to identify the different types of file formats as there are different file formats for different cases. Once it is identified measures can be used to analyze and recover data from it. The next step would be to check swap files as many information could be retrieved from it. However, if swap files are temporary it releases files to unlocated spaces, so as a further step examining unlocated spaces is also a must. The processing step of logical analysis is to first divide data on hard drives into layers. Later evidence is to be checked on each layer individually. This helps to check data independent of one another. 

2.

The types of storage format and issues related to it are listed below.

1. Magnetic media- It is a type of storage format used in computers. Hard disk drives and floppy drives are examples of magnetic media. In magnetic media, data are organized in tracks around the platter. The issues related to magnetic media are any interference of magnets demagnetizes the device. So it is sensitive to magnetics. Additionally, It has moving parts so it has to be handled with care; Dropping it may damage the data. 

2. Solid-state drive- it is a type of storage format which uses microchips. It can retain memory without using any power. Unlike magnetic media, it is less likely to be physically damaged, requires less power and starts time is faster too. The issues related to solid-state drive are it is expensive compared to magnetic media and even has low capacity. The other downside to it is it can only be used in small devices like tablets.

3. Digital audio tape drive- It is an old-fashioned storage format and it is similar to audiotapes. It looks like a magnetic tape closed inside a protective cover made of plastic, its main aim is to record data and the use of this drive is very common. It contains archived/ back up data so while doing a forensic test checking backups is also in must. The issues related to digital audio tape drive are they wear out after a certain time and will be no longer usable. Also, it can be replaced periodically. 

4. Digital liner tape and super DLT- it is similar to digital audio tape but it relies more on linear recording methods. 

5. Optical Media- Type of storage in which data is written in red with a laser. The examples of optical media are CDs and DVDs. The issues related to it or any scratch could be problematic for using it any further as it could damage the data. Also, it has limited storage as it can hold up to 25 to 150 GB only. 

6. USB- It is a storage type with connectivity technology. It is a small drive that is connected externally to any other device or hard drives. Pendrive, thumb drive are the types of USB. The issue related to USBs are it can easily be erased or overwritten.