Download now Free registration required
Computer forensics is defined as the process of capturing and analyzing digital data from many sources. The technology usually captures and analyzes data from computer mass storage devices like hard disks. The productivity and effectiveness of the forensic practitioner is greatly related to the number of disk acquisitions and the amount of data acquired. The speed with which a hard disk transfers data is dependent on many factors. The forensic practitioners also require features such as disk hashing to ensure best forensic practices during data acquisition process. This document is written with the aim of helping forensic practitioners with disk imaging tasks. The paper gives an overview of hard disk capacity and performance trends for the past three decades. This information is then used in the paper to show the growing magnitude of the challenges that are faced by computer forensic practitioners today. There is a section on a brief survey of modern disk acquisition methodologies, which is followed with a detailed, technical discussion of the factors that affect disk duplication or imaging performance. The paper also gives real-world data to illustrate the performance of typical, widely used forensic tools. Through the information shared in the paper, it is believed that forensic practitioners will get well-grounded, realistic expectations for their tools by making efficient choice through available equipment and information to optimize their daily work.
- Format: PDF
- Size: 180.1 KB