Reference no: EM133358459
1. Digital devices may be collected in a broken state with files already deleted. What methods can digital forensic practitioners employ to extract or recover these lost files?
2. Locard's exchange principle states, "A criminal action of an individual cannot occur without leaving a mark". Explain what this principle means for digital evidence.
3. Describe best practices that should be followed to ensure digital forensic practitioners don't leave their own "marks" on the evidence during collection and acquisition.
4. Choose three items of digital evidence from the following list and describe what types of digital "marks" (artifacts) might by left by a user. (Laptop, Router, External Hard Drive, Thumb Drive, Smartphone, Gaming Console, IoT devices, Home Surveillance Systems, Vehicles)
5. How can examiners/investigators use this information to prove or disprove the allegations under investigation?
6. What beneficial data may be found on the live system that would not be found on a powered off (dead) system?
- What actions should a digital forensic professional take when encountering a running (live) laptop?
7. Describe cloud storage and explain its importance to investigators.
- How can investigators preserve and gain access to cloud data?
- Do investigators need legal authorization to access the data? Why or why not?