Acquire the evidence without altering or damaging the original. Usually, professionals recommend to create two copies of the original evidence.
Authenticate the image, it's always a good idea to check "MD5 Hash -Match" of the image. Analyze the data without modifying it. EC Council Certified Hacking Forensic Investigator (CHFI)
SANS Certification EnCase Certification Access Data Certified Examiner Find Current database location
SELECT name, physical_name AS current_file_location FROM sys.master_files |
Mac Forensics
|