Digital Foreinsics Week 3 Discussion: Collecting, Seizing, and Protecting Evidence

1. Physical Analysis is an offline analysis performed on a disk or a forensic duplicate. It is used to gather data such as URLs and email addresses. When doing a Physical Analysis you should also index the file formats of the data that is found. Depending on the case that you are investigating will determine how the files are sorted. Data can be stored in a variety of file types. Images are typically stored as JPEG or PNG file types. Videos can be stored as MKV, MP4 and many more. There are environments in the computer that must be physically analyzed such as the swap file and any unallocated space that might hide critical data that the user was unaware of.

Logical Analysis is when you use the operating system to carefully read through the data. Logical analysis is used to determine what the user was doing with their computer. This information is then used to create a timeline.

2. There are a variety of storage formats that computers owners use to store data. Each poses its own set of issues for investigators performing analyses on the device.

a. Magnetic Media – Can be destroyed by the use of magnets.

b. Solid-State Drives – Data can be hidden and protected.

c. Digital Audio Tape Drives - Can be worn out over time due to use.

d. Digital Linear Tape and Super – Can be worn out over time due to use.

e. Optical Media – Discs can become damaged easily.

f. USB Drives – Can be easily erased or overwritten.

less