Information Technology Reference
In-Depth Information
Summary
Imaging a device is one of the primary steps to ensure that the data on the device is not
modified. Once the device is accessible, an examiner can extract the data using manual, lo-
gical, or physical data extraction techniques. Logical techniques extract the data by access-
ing the file system. While the physical techniques access a larger set of data, they are com-
plex and require great expertise to perform. Manual extraction should be performed to val-
idate data or only when one tool is used to create the image. Once the data is acquired, ex-
amination and manual extraction follows, as described in the next chapter.
