This chapter is from the book
Chapter Review
- In what ways does Casey’s six-step model differ from the earlier four-step models of digital investigation? What is new, and what has changed?
- Where in the Casey model would one begin to ascertain precisely what legal documentation would be required for a particular investigation?
- Is Zubulake v. UBS Warburg more relevant to a criminal case or a civil matter? Explain your answer.
- Discuss the difference between procedural documentation and process documentation. In which document would you explain what steps you took during the examination of a file system?
- During the process of examination, you have reason to suspect that files that were deleted may still exist. What is the process for locating intact files in unallocated disk space?