IT principles in digital investigation 2

As the lead for a digital forensics team you are now being asked by the forensics manager to give a training session on how to acquire digital evidence. The session must be given to your junior forensics team. In this training session, you will need to demonstrate how to acquire digital evidence without causing alteration through the use of both hardware and software write blocking and the preferred technology for this write blocking. In addition, the training must demonstrate how investigators perform detailed analysis of the evidence collected from formatted media, deleted files, allocated space, swap space, slack space, encrypted space, and unallocated space. These two demonstration areas are the most critical steps for junior investigators if they are to both completely understand the evidence acquisition process and places where suspect data may hide on formatted media.