 |
Creating a Forensic Image Using the Examiner's Computer This graphic illustrates the process of creating a bit-wise forensic image of a hard drive using a write blocker and software on the forensic examiner's computer. |
 |
Creating a Forensic Image Using a Cloning Device This graphic illustrates the process of creating a bit-wise forensic image of a hard drive using a special hard drive cloning device. |
 |
Creating a Forensic Image Using the Suspect's Computer This graphic illustrates the process of creating a bit-wise forensic image of a hard drive using a boot disk and the suspect computer. |
 |
Creating a Hard Drive Clone Using a Cloning Device This graphic illustrates the process of creating a clone of a hard drive using a special hard drive cloning device. |
 |
Forensic Image (clone) vs Active File (logical) Collection This graphic illustrates differences between collecting data using a forensic image or cloning process and collecting active file data. |
 |
Forensic Image vs Hard Drive Clone This graphic illustrates the similarities and differences between collecting data via forensic image and collecting data onto hard drive clones. |
 |
How are Deleted Files and Data Recovered? This graphic illustrates how deleted files and other data are recovered, what conditions make these files recoverable and which conditions make them unrecoverable. |
 |
How Are Evidence Copies Verified? This graphic illustrates the process of verifying that a copy of a set of data is exact. It also illustrates why hash values are used and some of their useful properties. |
 |
Preserve and Collect Computer Data This graphic illustrates the best practices for collection and preservation of electronically stored information. |
 |
Were Files Copied to an External Drive? This graphic illustrates how forensic computer examiners go about determining whether files or other data were copied to an external drive or other media. |
 |
What is a Hard Drive Clone? This graphic illustrates how a hard drive clone is an exact copy of the original data, but copied bit-for-bit to another hard drive to maintain deleted files and the original locations of any other data. |
 |
All of the Above This is a zip file containing each of the above trial graphics. |