GNED-135 Study Guide - Midterm Guide: Dod Cyber Crime Center, Computer Forensics, Uniform Crime Reports
Document Summary
A bit-stream copy is a bit-by-bit duplicate of the original disk. You should use the original disk whenever possible. Performing a forensic analysis of a disk 200 gb or larger can take several days and often involves running imaging software overnight and on weekends. Requirements for taking the ence certification exam depend on taking the guidance software encase training courses. If damage occurs to the floor, walls, ceilings, or furniture on your computer forensics lab, it does not need to be repaired immediately. A good working practice is to use less powerful workstations for mundane tasks and multipurpose workstations for the higher-end analysis tasks. Computing systems in a forensics lab should be able to process typical cases in a timely manner. One advantage with live acquisitions is that you are able to perform repeatable processes. The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your evidence image file.
