In Part 2 of this series on the introduction to cyber forensics, we examined several topics which form the basis for our understanding of how data eventually become digital evidence, including a review of volume versus partition, cylinder, head, sector, and Logical Block Addressing, File Systems, FAT 12/16 and NTFS, the File Allocation Table (FAT), Master File Table (MFT) and took a quick look at several alternative filing systems.
In Part 3 we continue the cyber forensic investigation process with an examination of the critical role that time plays in an investigation along with the presentation of forensic investigative smart practices. These smart practices represent the recommended step-by-step processes, for cyber forensic investigators desiring to maximize the potential for a successful cyber forensics investigation/assessment.
After completing this course, participants will be able to:
- Describe both the role and significance that time contributes, to cyber forensic investigations.
- Explain the foundations of forensic time
- Communicate the importance of time and date to the cyber forensic process
- Analyze the process for determining correct date and time associated with forensic evidence under review
- Comprehend the cyber forensic investigative process, enabling better management of ongoing and subsequent cyber forensic analyses.