Mon Textbook Chapter 3 summary

Chapter 3 Forensic methods and labs

Forensics need to be done in copied file while the original file is kept after copying. And don't do anything uncertain for you, don't exceed your knowledge area. Some volatile memories need to be collected quickly. Different approach can be made following different organisation's standard or manual. In forensics lab, you need hardware, software, and personal. Hardware include equipment and environment. Software is examining program like FTK. The personal can be accessed be their qualifications.