Guide to computer forensic

Solutions to review questions ch-3

1- Preservation of digital evidence.

2- Raw format, proprietary formats and advanced forensic format.
3- Advantages: faster data transfer speeds, ignores minor data errors and most forensics analysis
tools can read it.
Disadvantages: requires equal or greater target disk space, doesn’t contain
hash values in the raw file, might have to run a separate hash program to validate
raw format data and might not collect marginal (bad) blocks.
4- Can compress or not compress the acquisition data, can segment acquisition output files into
smaller volumes, allowing them to be archived to CD or DVD; case metadata can be added to
the acquisition file, eliminating the need to keep track of any additional validation
documentation or files.