This website uses cookies to ensure you have the best experience. Learn more

Re: Lesson 06 Discussion Question Essay

2837 words - 12 pages

Guide to Computer Forensics and Investigations Fourth Edition
Chapter 4 Data Acquisition

Objectives
• List digital evidence storage formats • Explain ways to determine the best acquisition method • Describe contingency planning for data acquisitions • Explain how to use acquisition tools

Guide to Computer Forensics and Investigations

2

Objectives (continued)
• Explain how to validate data acquisitions • Describe RAID acquisition methods • Explain how to use remote network acquisition tools • List other forensic tools available for data acquisitions

Guide to Computer Forensics and Investigations

3

Understanding Storage Formats for Digital Evidence
• Three formats
...view middle of the document...

afd for segmented image files and .afm for AFF metadata • AFF is open source

Guide to Computer Forensics and Investigations

8

Determining the Best Acquisition Method
• Types of acquisitions
– Static acquisitions and live acquisitions

• Four methods
– – – – Bit-stream disk-to-image file Bit-stream disk-to-disk Logical disk-to-disk or disk-to-disk data Sparse data copy of a file or folder

Guide to Computer Forensics and Investigations

9

Determining the Best Acquisition Method (continued)
• Bit-stream disk-to-image file
– – – – Most common method Can make more than one copy Copies are bit-for-bit replications of the original drive ProDiscover, EnCase, FTK, SMART, Sleuth Kit, XWays, iLook

• Bit-stream disk-to-disk
– When disk-to-image copy is not possible – Consider disk’s geometry configuration – EnCase, SafeBack, SnapCopy
Guide to Computer Forensics and Investigations 10

Determining the Best Acquisition Method (continued)
• Logical acquisition or sparse acquisition
– When your time is limited – Logical acquisition captures only specific files of interest to the case – Sparse acquisition also collects fragments of unallocated (deleted) data – For large disks – PST or OST mail files, RAID servers

Guide to Computer Forensics and Investigations

11

Determining the Best Acquisition Method (continued)
• When making a copy, consider:
– Size of the source disk
• Lossless compression might be useful • Use digital signatures for verification

– When working with large drives, an alternative is using tape backup systems – Whether you can retain the disk

Guide to Computer Forensics and Investigations

12

Contingency Planning for Image Acquisitions
• Create a duplicate copy of your evidence image file • Make at least two images of digital evidence
– Use different tools or techniques

• Copy host protected area of a disk drive as well
– Consider using a hardware acquisition tool that can access the drive at the BIOS level

• Be prepared to deal with encrypted drives
– Whole disk encryption feature in Windows Vista Ultimate and Enterprise editions
Guide to Computer Forensics and Investigations 13

Using Acquisition Tools
• Acquisition tools for Windows
– Advantages
• Make acquiring evidence from a suspect drive more convenient – Especially when used with hot-swappable devices

– Disadvantages
• Must protect acquired data with a well-tested writeblocking hardware device • Tools can’t acquire data from a disk’s host protected area

Guide to Computer Forensics and Investigations

14

Windows XP Write-Protection with USB Devices
• USB write-protection feature
– Blocks any writing to USB devices

• Target drive needs to be connected to an internal PATA (IDE), SATA, or SCSI controller • Steps to update the Registry for Windows XP SP2
– Back up the Registry – Modify the Registry with the write-protection feature – Create two desktop icons to automate switching between enabling...

Other Papers Like Re: Lesson 06 Discussion Question

Macro Management Essay

4663 words - 19 pages | |Lesson Plan | |Assessment Scheme and Schedule | |Model Question Paper (Semester End Examination (SEE)) | |Lectures Slides, Tutorials

Communication Essay

780 words - 4 pages to his opinions. I wouldn’t be surprised if some of the resistance was caused by purported feminists, which now causes him to think all women who challenge his teaching as a feminist. 4) Yes, the student should have asked the question. In a center of learning, we can only learn by having provocative and open discussion. As I stated before, if we refuse to ask questions our learning will be stunted. In addition, she has the right to ask the

Mr Gallon Man Siop Assignment

1295 words - 6 pages physically engaged as well. * Group discussion and following step by step instructions while creating of Mr. gallon Man on 11 x 14 colored construction paper will help students in learning through visual engagement, writing, auditory, and problem-solving. * Vocabulary learning takes place through the discussion and labeling portion of this lesson plan. * Students are also required to work in partners when creating Mr. Gallon Man. Visual

Methodology Terms

3812 words - 16 pages feedback, giving a presentation, acting a dialogue, or demonstrating an activity. Closed pair work (CPW) (S-S) - when two learners work together to complete a task or to have a discussion. Group work (GW) - 3 or more learners work together to complete tasks, e.g. oral fluency - a discussion task where students should answer a specific question. A mingle activity (Mingle) (S-S-S) - learners walk around the classroom talking to a specified number

Unit 401 Planning to Meet the Needs of Learners in Education and Training

1334 words - 6 pages and kinaesthetic learning styles. For example I could use a range of the following: * discussion * online research * group work * practical tasks * question / answer sessions * quizzes * role play * guest speakers Whichever activities chosen will be realistic and achievable for the learners and by following my schemes of work and lesson plans, I will be confident that they can be delivered and completed

Hsm 260

1862 words - 8 pages specified financial statements. | | | |Participation |Participate in class discussion. |06/22/14 |10 | |Capstone Discussion Question |Respond to the capstone discussion question. |06/17/14 |50

Learning Disabilities and the Classroom

1024 words - 5 pages they did not raise his or her hand, then she simply called another student to answer the question. Another important strategy that she incorporated into her classroom was keeping the students simply attentive, sitting up and participating in the discussion and lesson. For instance, if a child was slouching or trying to lay his or her head down on their desk, she would tell the immediately to sit up, follow along and she would then call on them to

Bird in the Classroom

536 words - 3 pages Today we are going to present the poem “Bird in the Classroom” by Colin Thiele. Before we go on, we will take a look at the title. The title has clearly answer us the question of the 5Ws, who, teacher and students; what, there is a bird fly over; where, inside the classroom; when, during the lesson. After looking at the title, we are going to read out the poem once. (Read Odd Number-Kennedy, Even Number-Richard) Now we are going to go

Concept of 3 Types of Assessment

2642 words - 11 pages over, I work though the exam paper using ‘Hands on Demonstration’. I go over the exam paper question by question starting form question number 1. I check students learning by using the question and answer technique. I provide students with the answers; this demonstrates how questions should be answered. During this question and answer session I ask students to perform a self-assessment. This is another technique which I found extremely useful

Why Do Students Cram?

1870 words - 8 pages Today’s tutorial covered study strategies, preparing to write exams and how to write a multiple choice exam. Our discussion topics included: * Does cramming work? Why/why not? * Does pulling an all-nighter to study for an exam the following day work? Why/why not? * How do you study for an exam? * How do you write a multiple choice exam? * What sources do you use to prepare for an exam? Some responses to, “Why do students

Methodological Approaches

2486 words - 10 pages of correcting another one if he or she gives an incorrect answer, for example, Question: “What does Jim do on Saturday?” Incorrect Answer: “He has baseball practice,” due to this is not the correct answer, the mate can raise his or her hand and correct it, “He works in a supermarket” but not a discussion. It is known as feedback. But it is true that another kind of chart or table could allow learners to ask and answer different types of

Related Essays

Dttl's Assignment 1

1665 words - 7 pages group; it also got them engaged with the lesson. The teacher made good use of this opportunity to review the knowledge that had been learnt so far, also to assess whether the class was retaining the knowledge that had been imparted to them. He did this by utilising assessment for learning techniques such as, effective questioning and by opening up a group discussion which encouraged the group to question each other, thus teaching the learners

Assessment Of Teaching Methods And Strategies

1668 words - 7 pages teacher shows all the activities given in the lesson to the students as an action and explains the important points before them during demonstration. The teacher in the demonstration follows three steps namely: The teacher introduces the lesson by question answer or lecture method, demonstrates each and every aspects of the lesson and develops it through activities, he makes the student drill of the subject matter for assimilation and then asks

The Study Of Micro Teaching Essay

1259 words - 6 pages available, can be shown. 3) Planning the Lesson : The student teacher prepares of lesson plan based on the pre-decided model on a suitable topic related to the concerned skill. 4) Teaching the Micro Lesson: The student teacher teaches the lesson to a small group of pupils. It is observed by the supervisor. 5) Discussion on the Lesson delivered: The lesson delivered by the trainee is followed by discussion to provide him feedback

Effective Classroom Management Essay

1768 words - 8 pages teacher can put up discussion questions throughout the assignment so students are focused on the lesson and are reminded of the lesson. An example discussion question could be “Humans, as well as animals, live in the desert. Compare and contrast the ways in which humans and animals have adapted to life in this habitat”. For students who are not working together the teacher will have to use personal judgment to see whether the students are choosing not